A NullMeridian record Andromeda Logs

NullMeridianLog

1 Jan 2024, 5:52–6:25 a.m. KST

Orbit Bridge: ~$81.5M Taken from Ethereum Vault

Ozys (Orbit Bridge): between 5:52 and 6:25 a.m. KST on 1 Jan 2024 an attacker took ~$81.5M in ETH, WBTC, USDT, USDC and DAI from the Ethereum vault. Ozys says not a contract bug or stolen validator key.

  • Event date
  • Incident typeBridge exploit
  • Bug classNot yet published
  • Published

Loss, as sourced

Approximately $81.5M (at time of exploit) in ETH, WBTC, USDT, USDC and DAI, per Ozys CEO statement. Funds swapped to ETH and DAI and split across eight wallets.

Traceability

Primary sources

  1. 01medium.comOzys Official Statement, 25 Jan 2024 (opens in a new tab)

In brief

Root cause: Per Ozys: not a smart-contract vulnerability or stolen validator key. Statement notes that on 22 Nov 2023 a former CISO had arbitrarily changed firewall policies shortly before leaving; investigation with NIS, police, KISA and Theori ongoing.

Timeline, as sourced: Per Ozys (KST, 1 Jan): 5:52–6:25 six theft events; 7:05 team alerted; 7:21 vault shut down; 10:00 Seoul police notified; 10:35 KISA notified. Statement 25 Jan 2024.

Account, as sourced

Claimed (Ozys) (statement (opens in a new tab)): full cause still under investigation with law enforcement.

Unknown: definitive technical root cause.

Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.

Permalinkhttps://andromeda.observer/e/orbit-bridge-ethereum-vault-2024