Bessie Liu


<p>Orbit Chain, a cross-chain bridging project, has lost over $80 million in assets in a preventable bridge hack over the new year.</p>



<p>The South Korean company is not to be confused with Orbiter Finance, an Ethereum-based cross-rollup bridge with a similar name.</p>



<p>According to a researcher who goes by the pseudonym <a href="https://twitter.com/officer_cia/status/1741579737825251647">officer_cia</a>, the attacker had obtained access to seven out of ten multisig signers, resulting in losses totaling $81.5 million.&nbsp;</p>



<p>Multisig, short for multi-signature, requires multiple private keyholders to sign a transaction and is normally used to prevent one single party from controlling the wallet.</p>



<p>Most of the stolen funds were in stablecoins, including $30 million in USDT, $10 million in USDC and $10 million in DAI; an estimated 231 WBTC ($10 million)&nbsp; and 9,500 ETH ($21.5 million) were also lost.&nbsp;</p>



<p>An intermediary address was used to transfer stolen funds before they were moved through a cryptocurrency mixer.</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">The exploiter initially funded with 10 <a href="https://twitter.com/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw">$ETH</a> from <a href="https://twitter.com/hashtag/TornadoCash?src=hash&amp;ref_src=twsrc%5Etfw">#TornadoCash</a> and transferred them through the intermediary address 0x70462bfb204bf3ccb0560f259072f8e3a85b3512<br><br>Infographics by <a href="https://twitter.com/peckshield?ref_src=twsrc%5Etfw">@peckshield</a> <br><br>Sent info about how one can de-mix Tornado to <a href="https://twitter.com/xyz_remedy?ref_src=twsrc%5Etfw">@xyz_remedy</a> Discord server (off-topic) fyi. <a href="https://t.co/95kMBOnIW2">pic.twitter.com/95kMBOnIW2</a></p>&mdash; Officer&#39;s Notes (@officer_cia) <a href="https://twitter.com/officer_cia/status/1741625864117194963?ref_src=twsrc%5Etfw">January 1, 2024</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>The Orbit Chain team has requested cryptocurrency exchanges to freeze the stolen assets, and the team is currently speaking with law enforcement to track the missing assets.</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">Orbit Chain team has developed a system for investigation support and cause analysis with the Korean National Police Agency and KISA (Korea Internet &amp; Security Agency), enabling a more proactive and comprehensive investigation approach. <br><br>Furthermore, we are also discussing close…</p>&mdash; Orbit Chain (@Orbit_Chain) <a href="https://twitter.com/Orbit_Chain/status/1742132887301107780?ref_src=twsrc%5Etfw">January 2, 2024</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>Additional warnings have been posted to prevent users from engaging with reimbursement claims, which have also been circulating.&nbsp;</p>



<h2 class="wp-block-heading">Unsecured infrastructure&nbsp;</h2>



<p>Orbit Bridge is not the first infrastructure created by Ozys, a South Korean blockchain development company, to have been hacked in recent years, according to <a href="https://twitter.com/tayvano_">Taylor Monahan</a>, Lead Product Manager at Metamask.&nbsp;</p>



<p>KlaySwap and Belt Finance, also creations of Ozys, have also seen their protocols drained of cryptocurrencies. Belt Finance lost an estimated $6 million in May 2021, and an additional $60 million was put at risk in August 2021. KlaySwap had its protocol drained of almost $2 million in February 2022.&nbsp;</p>



<p>Neither hack was ever attributed to an organized group, but Monahan <a href="https://twitter.com/tayvano_/status/1741685573566476655">notes</a> that it is important for projects to learn from previous mistakes.</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">The lack of learning is whats most embarrassing about this industry.<br><br>At this point it&#39;s honestly fucking disgusting.<br><br>If you dont want to be bothered to secure your shit, then don&#39;t build shit. Thanks.</p>&mdash; Tay 💖 (@tayvano_) <a href="https://twitter.com/tayvano_/status/1741685573566476655?ref_src=twsrc%5Etfw">January 1, 2024</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<h2 class="wp-block-heading">Multisig risks</h2>



<p>Exploits related to private key compromise are among the most common.&nbsp;</p>



<p>It was a factor in the high-profile <a href="https://blockworks.co/news/axie-infinity-developers-made-some-trade-offs-that-enabled-625m-ronin-breach">Ronin Bridge exploit of March 2022</a>, when hackers drained $625 million.</p>



<p>According to Web3 security firm Quantstamp, “compromised keys were the biggest threat of 2023.”</p>



<p>Recent analysis from smart contract auditor Certik concluded $880 million were lost across 47 incidents — just 6.3% of all security incidents — representing nearly half of all financial losses. That makes private key compromises the most costly attack vector last year.</p>



<p>“It doesn&#8217;t really matter who hacks you…All that matters is that you [wrecked] people who trusted you, for better [or] worse,” Monahan wrote in a post on <a href="https://twitter.com/tayvano_/status/1741684930017652896">X</a>. “Ideally, you learn from your mistakes and share lessons learned with others so that less people get [wrecked] in the future, not more.”</p>



<p><em>Macauley Peterson contributed reporting.</em></p>



<hr class="wp-block-separator has-alpha-channel-opacity"/>



<p><strong>Get the news in your inbox. Explore Blockworks newsletters:</strong></p>



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown"><strong>The Breakdown</strong></a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch"><strong>0xResearch</strong></a>: Alpha in your inbox. Think like an analyst. </li>
</ul>


Taylor Monahan

Newsletter

Blockworks Research