Orbit Chain suffers exploit on decentralized Orbit Bridge protocol

b – live.staticflickr.com

Cross-chain Orbit Chain has announced that its Orbit Bridge protocol was breached by hackers on December 31, 2023.

“Dear Orbit Bridge Users, An unidentified access to Orbit Bridge, a decentralized Cross-chain protocol, was confirmed on Dec-31-2023 08:52:47 PM +UTC. Further information regarding the issue will be updated,” said Orbit in a social media post.

A user on X (formerly Twitter) with the handle Kgjr highlighted Orbit’s exploit, noting significant outflows from its protocol.

“Looks like orbit bridge is getting drained right now, different fresh wallets for wbtc usdt usdc and dai, test tx’s showup on orbit bridge scanner but bigger ones doesnt,” Kgjr said.

On-chain investigator Officer CIA and blockchain security company Cyvers have also shared similar details.

“Looks like the Orbit bridge is hacked. The first hack in 2024,” it said.

Officer CIA suggested that the hacker might have gained access to seven out of 10 multi-signature signers. The exploiter initially received 10 ETH from TornadoCash, a popular currency mixing service among hackers, and then transferred the funds through an intermediary address.

Orbit shared that it is conducting a thorough analysis of the breach with the cybersecurity startup Theori.

“Our efforts to communicate with the attackers of the Orbit Bridge are continuing, and we have delivered a second message to them (Jan-01-2024 01:08:35 PM +UTC),” Orbit said.

It also revealed that it is “actively engaging” with international law enforcement agencies.

Arkham Intelligence’s data shows hackers stole $81.68 million in various cryptocurrencies. They moved $30 million in Tether (USDT), $10 million in USD Coin (USDC), $21.7 million in Ether (ETH), $9.8 million in Wrapped Bitcoin (WBTC) and $10 million in Dai (DAI) across five transactions to new wallets.

The Orbit Chain protocol has strong connections to the Klaytn network, a modular layer-1 blockchain. Data from Klaytn’s block explorer indicates that eight of the top assets by market capitalization on the Klaytn network are wrapped assets on the Orbit Bridge.

In response to the breach, Orbit warned users not to fall for scam reimbursement offers, which have begun circulating on social media under accounts with similarly named handles.

“Any reimbursement claims currently circulating are scams. Please don’t engage. Only refer to this official account @Orbit_Chain for updates, which will be provided as the situation unfolds,” Orbit said.

December crypto breach nearly reaches $100M

Blockchain security firm PeckShield revealed that the latest breach at Orbit Bridge has increased the total crypto stolen in December to nearly $100 million.

“#PeckShieldAlert Hackers stole ~$99.3 million across over 36 attacks in December,” Peckshield said in a social media post.

PeckShield emphasized that the $81.68 million exploit on Orbit Bridge meant that December was the fifth-highest month for hacks in 2023. It also said the exploit ranked as the ninth-highest hack targeting a cross-chain bridge in the past three years.

PeckShield and two other blockchain security firms, CertiK and Beosin, estimated that the total crypto losses due to hacks, scams and exploits in 2023 ranged between $1.51 billion and $2 billion. According to PeckShield’s data, September and November were particularly damaging months, accounting for over $700 million in losses.

In September, Mixin Network lost $200 million, while the biggest exploits in November happened on Poloniex and HTX/Heco Bridge, resulting in losses of $131.4 million and $113.3 million, respectively. Additionally, notable hacks during the year involved Euler Finance being exploited for $197 million in March and Multichain being hacked for $125 million in July.