Blockchain company Harmony has reached out to the FBI following a heist of close to $100 million in cryptocurrency that was stolen on the evening of June 23rd. Harmony is an organization that assists its users in “sending cryptocurrencies, stablecoins, and NFTs between different blockchains.” The company also runs multiple cryptocurrency bridges, the platform used to transfer assets and smart contract instructions across blockchains. One of its bridges, Horizon, allows transfers between Ethereum and Binance Smart Chain through the Harmony blockchain. On the evening of June 23rd, an attacker was able to compromise the private keys held by the administrators of the bridge. Harmony’s bridge is secured by a “2-out-of-4 multisig,” meaning at least two (2) of the four (4) private keys generated for the wallet must sign a transaction together. Through an unknown method, the threat actor gained access to two of the private keys, allowing complete control over the transactions made through the bridge. The blockchain security company CertiK has criticized Harmony for using this security method for its Horizon bridge, stating “Horizon’s system of only requiring two (2) out of four (4) signatures has raised concerns in the past. Having only two signatures required to access such privileged controls is a glaring security vulnerability.” Attacks against cryptocurrency bridges are on the rise. With millions of dollars being transferred through the bridges every day, it is an extremely profitable attack vector for threat actors. The FBI and several cybersecurity firms have begun an investigation into this attack, though no attribution has been made. CTIX analysts are continuing to monitor the situation and will provide updates for any new developments.