Curriculum·J301 Chains, Layer 2s, and Bridges·about 33 min
Bridge risk, specifically
By the end of this lesson you can
- →State why a bridge's security is its smallest quorum rather than its average
- →Explain the structural inversion that makes bridges the largest exploit category
- →Compute your exposure as time in transit rather than as amount bridged
- →Adjust the threat model for a state-resourced adversary targeting this category
Junior · enrolled learners
This lesson opens with Harmony Horizon bridge, June 2022.
- What happened
- The Horizon bridge between Harmony and Ethereum was governed by what amounted to a two-of-five multisig, meaning any two of the five addresses could authorize a transfer of funds. The keys were held by Harmony, doubly encrypted with a passphrase and a key management service. An attacker accessed and decrypted a number of them, obtained the two signatures required, and drained about $99.7M on 23 June 2022. The FBI subsequently confirmed that the Lazarus Group, backed by North Korea, was responsible. Around $40M was frozen or recovered by exchanges, and the FBI reported that over $60M of the stolen Ethereum was laundered through the RAILGUN privacy protocol. Harmony moved the Ethereum side of the bridge to a four-of-five threshold afterwards.
- The decision point
- Harmony the chain was secured by a large validator set. The bridge holding the assets that had crossed into it was secured by two keys. The remedy adopted afterwards, raising the threshold to four of five, is the clearest possible statement of where the security had actually been: not in the chain, not in the code, and not in the encryption, but in a quorum small enough that compromising two people compromised everything anyone had ever bridged.
- Recorded loss
- $99,700,000
What you will be able to answer
- →What is a bridge's security equal to?
- →What is the structural inversion?
- →How should you measure bridge exposure?
- →What did the post-incident fix reveal?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://www.fbi.gov/news/press-releases/fbi-confirms-lazarus-group-cyber-actors-responsible-for-harmonys-horizon-bridge-currency-theft
- https://www.elliptic.co/blog/analysis/fbi-confirms-north-korea-s-lazarus-group-as-hackers-behind-100-million-harmony-horizon-bridge-theft
- https://medium.com/harmony-one/harmony-s-horizon-bridge-hack-1e8d283b6d66
- https://www.elliptic.co/blog/analysis/over-1-billion-stolen-from-bridges-so-far-in-2022-as-harmony-s-horizon-bridge-becomes-latest-victim-in-100-million-hack/hss_channeltw-1344645140
Confidence high·Volatility medium·Reviewed 2026-08-06·Owner unassigned
Contested
The cost of compromising a given quorum cannot be computed from outside, which is the honest state of the analysis. This lesson uses the ratio to show the direction of the problem rather than to produce a number, and says so in the worked example.
Harmony disclosed the incident, published its own analysis and raised the threshold. Naming it is not a judgment about the team's response, which was more transparent than several comparable cases.