How much was lost in the Orbit Bridge hack?

$82M New Year's Hack, as publicly reported (January 1, 2024).

Who was behind the Orbit Bridge hack?

Publicly attributed to Lazarus Group (suspected). ChainHint does not attribute the attacker independently — it traces the funds from the address on the public record and reports where they went.

Case Studies/Orbit Bridge

Orbit Bridge Hack: $82M New Year's Hack

Q: How was the Orbit Bridge hack carried out?

Multi-sig Compromise. The attacker forged or obtained 7 of 10 multi-sig signatures required to authorize bridge withdrawals. Evidence points to either a supply-chain compromise of a signer's environment or a rogue insider who had access to multiple key shares.

January 1, 2024 · Ethereum / BNB / Polygon · Lazarus Group (suspected)

stolen

$82M

transactions

chains hit

recovered

What happened

In the final hours of 2023 (23:00 UTC, December 31), Orbit Bridge — a cross-chain bridge operated by the Ozys team — was drained of $82M across five transactions. The attacker targeted USDT, USDC, DAI, WBTC, and ETH reserves held on Ethereum, routing funds simultaneously to BSC and Polygon. The exploit is believed to have leveraged a compromised multi-sig key or a rogue insider; on-chain evidence showed the attacker bypassed the bridge's 7-of-10 multi-sig by forging signatures, or accessing signer keys. Blockchain security firm Theori and Ozys attributed the attack to Lazarus Group based on TTPs and fund-flow patterns. Approximately $82M remains unrecovered.

How the funds moved

Step 1

Multi-sig Compromise

The attacker forged or obtained 7 of 10 multi-sig signatures required to authorize bridge withdrawals. Evidence points to either a supply-chain compromise of a signer's environment or a rogue insider who had access to multiple key shares.

Step 2

Multi-chain Drain

Five large transactions executed within minutes: 30M USDT, 10M USDC, 10M DAI, 231 WBTC (~$9.8M), and 9,500 ETH (~$21.5M) withdrawn from Ethereum mainnet reserves. Bridge contracts on BSC and Polygon confirmed matching withdrawal events simultaneously.

Step 3

Laundering via Tornado Cash

ETH proceeds immediately routed through Tornado Cash pools (10 ETH and 100 ETH denominations). USDT and USDC converted to ETH via 1inch and Uniswap before mixing. WBTC bridged to Bitcoin network via Ren Protocol remnants and mixing services.

Key findings

Primary Exploiter

0x009f…eca6Orchestrated the 5-transaction drain from Ethereum reserves. Deployed mixing immediately post-exploit — consistent with Lazarus operational tempo.

Lazarus GroupMulti-sig Bypass

Affected Chains

Ethereum + BNB Chain + PolygonFirst major bridge exploit of 2024. Ethereum: ETH + stablecoins. BSC: USDT, USDC. Polygon: DAI. Simultaneous multi-chain withdrawal in a single coordinated attack.

Multi-chain

Laundering Route

Tornado Cash + 1inch + UniswapStandard Lazarus playbook: stablecoins → ETH via DEX aggregators → Tornado Cash pools. WBTC path: Ren Protocol bridge → Bitcoin → Bitcoin mixing services.

Tornado Cash

Attribution

Lazarus Group (DPRK) — suspectedAttributed by Theori and Ozys based on on-chain TTP pattern matching. Consistent with Lazarus use of multi-sig compromise, immediate Tornado Cash routing, and New Year's timing (same pattern as Harmony Horizon Bridge).

Investigate your own incident

ChainHint traced the Orbit Bridge hack in minutes.
Use the same tool for your case.