Kill Chain: Inside North Korea's $100M Bridge Heist:
I ran the Harmony Horizon Bridge hack through a kill chain analysis. The "official" story is thin.
I’m supposed to be an expert on nation-state hacking. I’d never heard of one of North Korea’s biggest crypto heists until last week.
I just finished listening to the second season of Nicole Perlroth’s To Catch a Thief limited podcast series (6 episodes). Last season was all about Chinese cyber operations and it was fantastic. It could have been a book. In fact, the Cybersecurity Canon Project has nominated it for the Hall of Fame this year.
Season 2 is about North Korean cyber operations and, I have to admit, I learned some things. I’m supposed to be an expert on this stuff, but Nicole presented details about this nation-state cyber operator that I didn’t know before. Well done, Nicole.
In one part of the series, she provided the details to the North Korean attack campaign commonly referred to as the Harmony Horizon Bridge Hack. Much to my chagrin, I didn’t know anything about it. I’ll talk about why that’s the case in a bit, but first, some background.
What is the Harmony Horizon Bridge Hack?
In June of 2022, North Korean hackers (AKA the Lazarus Group) stole roughly $100M USD from the Harmony Horizon Bridge service. Harmony is a U.S.-based blockchain startup that provides infrastructure for decentralized applications, cryptocurrency transactions, and other blockchain services. The Bridge is a Harmony service; a technology designed to transfer crypto assets between Harmony and other blockchains. The hackers compromised the Bridge and intercepted transfers from
Ether (ETH) — native coin of the Ethereum network
BNB (BNB) — native coin of the BNB Chain ecosystem
USD Coin (USDC) — dollar-pegged stablecoin
Tether (USDT) — dollar-pegged stablecoin
Binance USD (BUSD) — dollar-pegged stablecoin
Wrapped Bitcoin (WBTC) — token representing Bitcoin on other blockchains
Dai (DAI) — decentralized, dollar-pegged stablecoin
Attribution
Before I start, let me be clear. The “Lazarus Group” label does not necessarily describe one team of North Korean hackers sitting together and putting fingers on keyboards. It’s an umbrella label that intelligence analysts apply inconsistently to several overlapping North Korean cyber operations. The phrase is neither synonymous with all North Korean cyber operations, nor does it describe a specific attack campaign across the kill chain to one or more specific victims. For example, TraderTraitor is another U.S.-government label for a North Korean campaign targeting organizations in the blockchain and cryptocurrency industries.
Note: Don’t get me started about the deplorable naming conventions we all use as shorthand to talk about cyber attacks. After 30 years, you’d think we would have gotten this right by now. The short version is this. There is a difference between a group of people who do the hacks, the campaigns that they run, and in some cases, the nation-state behind both giving the orders and providing support. To eliminate confusion, all of those should have different names. Just saying …
Elliptic, a blockchain-intelligence company similar to Chainalysis or TRM Labs, initially assessed that the Lazarus Group was responsible based on blockchain tracing and laundering behavior. The FBI later also attributed the attack to Lazarus, and the Treasury Department sanctioned a mixer service used to launder the stolen funds, citing the Horizon Bridge heist as one of several DPRK-linked thefts it processed
But none of these organizations provided any details about how. They didn’t match any specific Tactics, Techniques, and Procedures (TTPs) used in the Harmony attack to any other known attack campaigns in the MITRE ATT&CK Framework or elsewhere.
Nevertheless, Harmony’s description of the attack identifies tradecraft consistent with the broader Lazarus pattern. Attackers
phished a developer and induced them to install malicious software.
gained access to Harmony’s internal infrastructure.
compromised at least two bridge-validator private keys.
used those keys to authorize fraudulent withdrawals from the bridge.
laundered the stolen cryptocurrency through Tornado Cash.
The bottom line is that there is consensus that North Korea sanctioned the Harmony Horizon Bridge attack. There is less confidence about which North Korean hacker group actually pulled the trigger and even less detail about the specific attack sequence across the kill chain.
I’m going to talk about those details in a second. But first, I want to briefly touch on why I think the collective reaction to crypto company hacks doesn’t raise any eyebrows in our security community. I’m assuming that since I hadn’t heard about the Harmony Horizon Bridge Hack, most of the community hadn’t either. Why is that?
Why Am I Not Paying Attention to These Crypto Hacks?
TRM Labs said this month (July 2026) that the crypto industry experienced approximately 207 reported attacks during the first half of 2026, resulting in about $972 million in losses.
For comparison, I estimate the healthcare industry’s dollar losses for that same time period to be between $440M and $1.15B and the financial sector’s dollar losses to be between $465M and $990M. They are in the same ballpark as the crypto industry. So, why do I care about healthcare and finance, but not crypto?
Here’s my hot take. I don’t have a lot of sympathy for the crypto bros who have lost money in these hacker attacks. They typically don’t understand the technology. The blockchain itself is highly resistant to tampering, so that’s never been the security problem. The security problem is when the users, the crypto bros, have to take the tokens out of the system and convert them to cash.
Crypto companies, like Harmony, are still in the startup phase. They may be very wealthy, but they are still moving fast and breaking things. They make products, like the Harmony Bridge, without a robust security architecture fully deployed. So, when your tokens are stored in the blockchain, they are relatively secure. But when you try to cash them out, you’re using startup technology that emphasizes deploying revenue-generating products over securing those financial transactions. The applications, organizations, and people surrounding the edge of the blockchain are the weakest links.
The advice from the experts that Nicole Perlroth interviewed in her podcast was that you should not have money in any crypto system that you’re not willing to lose. I agree with her and that’s why I don’t normally spend a lot energy worrying about the victims.
But that doesn’t mean that we shouldn’t analyze the North Korean attack sequence to see what we might learn.
The Kill Chain: Why Do We Study It?
Regular readers already know that I wrote a book on cybersecurity first principles.
In it, I talk about the various strategies to consider in pursuit of achieving the ultimate cybersecurity first principle:
Reduce the probability of material impact due to a cyber event within the next business cycle.
The Intrusion Kill Chain Prevention strategy is one to consider. The idea is that regardless of which adversary group is running the attack (the Lazarus Group, Wicked Spider, or some other group) and regardless of the group’s motivations (nation-state, crime, etc.), hacker groups have to successfully execute a sequence of steps across a chain of activity, the kill chain, in order to be successful. That’s an advantage for the defender. If we can break one or more links in the sequence, we can defeat the adversary.
For example, if the Wicked Spider campaign has 100 steps in the attack sequence and the defender has deployed a prevention control for one of those steps, then the defender might stop the Wicked Spider attack campaign; maybe. But, if the defender deploys 100 prevention controls, one for each step in the known campaign, then the defender exponentially increases the chances of defeating the Wicked Spider attack campaign. The more controls you have in place, the less likely it is for the hackers behind Wicked Spider to find a way around.
There are three primary reasons to study adversary kill chains then. The most important is to understand the adversary TTPs so that you can deploy security controls to counter them. The second reason is to share that intelligence with the rest of the community. In that way, everybody can deploy multiple prevention controls designed to stop Wicked Spider. That makes the entire ecosystem safer. That’s information sharing 101. The last reason is for the victim to determine if they’ve found every place that Wicked Spider has burrowed into their environment. If you just found how the hackers behind Wicked Spider compromised victim zero but have no idea how they handled command and control, you have some more investigation to do.
So, kill chain analysis is a useful tool. Let’s use it to examine the Harmony Horizon Bridge Hack.
The Harmony Horizon Bridge Hack Kill Chain
For this analysis, I used the following conventions:
Tier 1: Facts are multi-sourced and independently verifiable.
Tier 2: Claims are sourced only to Harmony’s own post-mortem.
Tier 3: Content is not attested to the specific Harmony hack at all; it is imported by analogy from general-purpose North Korean attack analysis by three U.S. government agencies:
Cybersecurity and Infrastructure Security Agency (CISA)
Federal Bureau of Investigation (FBI)
U.S. Department of the Treasury
1. Reconnaissance — Tier 2
Harmony states that server logs showed attacker(s) “reviewing the Horizon Bridge implementations as early as June 2, 2022.” That’s three weeks before the theft. In the Harmony post-mortem, there is no mention of other probing activity. Employees don’t know exactly how the hackers found their way to the Bridge technology.
2. Weaponization — Tier 3
There is zero Harmony-specific evidence here. Harmony’s account says only that the attacker used “malicious software” or “trojan-horse software.” They don’t mention a malware family, file hash, toolset, or exploit. They probably know but why wouldn’t they mention it? Let’s not assume they do.
3. Delivery — Tier 2, with a Tier 3 shadow
Harmony states the hackers compromised victim zero on June 17, 2022, via “a phishing scheme to trick at least one software developer to install malicious software on their laptop.” They didn’t provide any details.
They did frequently refer to another crypto company hack as being similar. That company was Sky Mavis, and its compromised product is called Ronin. In that attack, hackers lured a Sky Mavis engineer via a fake LinkedIn recruiter and a malicious PDF “offer letter.” Harmony implies that because of that weak connection, it must be the same group. In truth, some version of that story is present in all attack campaigns. That’s not enough to attribute the North Koreans.
4. Exploitation — Tier 2
Harmony states the malware gave the attacker the ability to “read chat threads to understand how to operate the bridge, and/or gain access to non-public bridge infrastructure code.” They don’t actually know how the hackers did it, but they think that’s the most likely explanation.
Separately, Harmony describes a June 18 vulnerability in a software package used by its internal “subgraph” service. Harmony believes that by exploiting that vulnerability, the hackers gained access to the addresses of all servers in its private cloud. Maybe. They don’t provide any details regarding how the hackers did that, so who knows?
5. Installation — Tier 2
Harmony states the attackers obtained “backdoor access to one or more servers.” This implies that they compromised multiple signing keys in order to get in and that they were conducting operations from inside the Harmony environment. They imply that hackers using compromised credentials of a software developer gave them access to do the installation.
6. Command and Control — Tier 3
There is no Harmony-specific public reporting on C2 infrastructure. Any assumptions other analysts make about how the attackers did it are purely speculative and based on other North Korean attacks. The fact that Harmony doesn’t really know how the hackers downloaded malicious software into their environment is troubling.
7. Actions on Objectives — Tier 1
At 11:06:46 UTC on June 23, 2022, attackers compromised several transaction signing keys to authorize fraudulent withdrawals. They executed between 11 and 14 transactions and drained assets affecting an estimated ~64,000 wallets holding Harmony Bridge tokens.
8. After the Attack - Tier 1
According to Elliptic, after the attack, the North Korean hackers laundered the tokens through various other exchanges:
85,837 ETH via Uniswap
Then several batches into Tornado Cash.
Roughly $60M more was moved through the RAILGUN privacy protocol starting January 13, 2023, partially converted to BTC.
Takeaways
North Korea’s $100 million theft from Harmony’s Horizon Bridge was one of the largest cryptocurrency heists of 2022. Years later, much of the public account remains incomplete or speculative.
The broader takeaway is that the cybersecurity community may dismiss cryptocurrency hacks because many of us view crypto as a speculative, immature industry whose participants knowingly accept the risk (or maybe should know the risk). But with losses comparable to those in healthcare and finance, that indifference is difficult to justify when the stolen money funds North Korean state objectives. Studying the attack’s kill chain matters because attribution alone does not help defenders: reconstructing each step reveals where preventive controls could have interrupted the operation, helps other organizations defend against similar campaigns, and shows investigators whether attackers still have access. The Harmony case ultimately exposes two failures: crypto companies continue to build vulnerable systems around otherwise resilient blockchains, and incomplete public reporting prevents the broader security community from learning enough to stop the next attack.
Source
Nicole Perlroth, 2026. To Catch a Thief [Limited Series Podcast]. Rubrik, URL: https://www.rubrik.com/lp/to-catch-a-thief-podcast
References
Jack Chan, 2022. Summary of the Harmony Horizon Bridge Incident [Explainer]. Medium, URL: https://medium.com/harmony-one/summary-of-the-harmony-horizon-bridge-incident-f9bd87c0c68e
Joanna Grama, 2026. To Catch a Thief: China’s Rise to Cyber Supremacy [2026 Canon Hall of Fame Nominated Podcast]. CyberCanon, URL: https://cybercanon.org/to-catch-a-thief-chinas-rise-to-cyber-supremacy/
Rick Howard, 2023. Cybersecurity First Principles: A Reboot of Strategy and Tactics [2026 Canon Hall of Fame Book]. CyberCanon,
Canon Review: https://cybercanon.org/cybersecurity-first-principles-a-reboot-of-strategy-and-tactics/
Amazon: https://amzn.to/4mI7QMUStaff, 2026. H1 2026 Crypto Hacks Reach Record High as Losses Fall Below USD 1 Billion [Analysis]. TRM Labs, URL: https://www.trmlabs.com/resources/blog/h1-2026-crypto-hacks-reach-record-high-as-losses-fall-below-usd-1-billion
Staff, 2022. The $100 Million Horizon Hack: Following the Trail Through Tornado Cash to North Korea [Analysis]. Elliptic, URL: https://www.elliptic.co/blog/analysis/the-100-million-horizon-hack-following-the-trail-through-tornado-cash-to-north-korea
Staff, 2023. FBI Confirms Lazarus Group Cyber Actors Responsible for Harmony’s Horizon Bridge Currency Theft [Government Report]. Federal Bureau of Investigation (FBI), URL: https://www.fbi.gov/news/press-releases/fbi-confirms-lazarus-group-cyber-actors-responsible-for-harmonys-horizon-bridge-currency-theft
Staff, 2023. Treasury Sanctions Mixer Used by the DPRK to Launder Stolen Virtual Currency [Government Report]. U.S. Department of the Treasury, URL: https://home.treasury.gov/news/press-releases/jy1933
Staff, 2025. The Bybit Hack: Following North Korea’s Largest Exploit [Report]. TRM Labs, URL: https://www.trmlabs.com/resources/blog/the-bybit-hack-following-north-koreas-largest-exploit
I used Claude Code to
Check for grammar and spelling errors.
Flag passive voice.
Suggest changes to awkward sentence construction.
Create images.
Fact-check.
Stress-test my thesis.