Multisig governance for an institution

Graduate · enrolled learners

This lesson opens with Harmony Horizon bridge, June 2022.

What happened

The Harmony Horizon bridge, which moved assets between Ethereum and the Harmony chain, was controlled by a multisig that required only 2 of 5 signatures to authorize a transfer. In June 2022 attackers, later attributed to the North Korea-aligned Lazarus group, compromised two of the five signer keys, which was all the threshold demanded, and used them to drain about 100 million dollars. Five keys existed, and the security of the whole bridge was the security of any two of them, because two signatures moved everything. The keys were not independent enough and the threshold was not high enough for the value at stake: an attacker did not need to beat five, they needed to beat two, and against a determined state-linked group, two was reachable. The number of keys looked reassuring and the threshold is what actually decided the system's strength.

The decision point

A multisig's headline, five keys, hides the number that matters, the threshold, and an institution that reads the wrong one builds Harmony. The security of a multisig is not how many keys exist but the smallest set of signers an attacker must compromise to reach the threshold, which for a 2-of-5 is two. So multisig governance is three deliberate choices. The threshold, set high enough that compromising the required number is genuinely hard for the value and the threat, which for a hundred-million-dollar bridge against a state actor is not two. The independence of the signers, so that the required signatures sit with different people, organizations, devices and locations, and no single compromise, phishing campaign, or insider can gather several at once. And the lifecycle, so a signer who leaves, is compromised, or loses a key can be removed and replaced without freezing the assets or lowering the bar. Harmony is a multisig that got the count right and the governance wrong.

Recorded loss

$100,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.