Harmony Bridge hack fund tracker
2022-06-23 · about $100.0M stolen · Validator key compromise
First stop for the funds
Where transfers out of the tagged wallets went first, valued on the day of each transfer.
When the funds moved
Value moved out of the tagged wallets each month (transfers of $10K or more).
Funds trail, step by step
| Step | Went to | Value |
|---|---|---|
| 1st hop | Plain wallets | $65.1M |
| 1st hop | Exchanges: HTX $7.2M, Binance $3.9M | $11.0M |
| 1st hop | Contracts (swap services, bridges, other apps) | $8.3M |
| 2nd hop | Contracts (swap services, bridges, other apps) | $61.7M |
| 2nd hop | Plain wallets | $49.2M |
| 2nd hop | Exchanges: HTX $12.3M | $12.3M |
The 2nd hop follows ETH sent on by the 10 wallets that received the most in the 1st hop. Funds can pass through the same wallets more than once, so these totals can be larger than the amount stolen. “Contracts” are smart contracts such as swap services, bridges and other apps without a public label in our lists; “plain wallets” are ordinary addresses. Laundering usually runs through many of both, and through other chains we don’t follow.
Wallets that received the most
| Wallet | Received from attacker | ETH there now |
|---|---|---|
| 0xc3f2c8…11ac88 contract | $6.9M | 0.00 |
| 0xebfd85…211d9f | $3.6M | 0.00 |
| 0x09c964…93b2f5 | $3.6M | 0.00 |
| 0x2c3813…e16ea5 | $3.3M | 0.00 |
| 0x00f9f2…1cee3a | $2.9M | 0.00 |
| 0xf69f34…1d0216 | $2.6M | 0.00 |
| 0x7fa912…af12d9 | $2.3M | 0.00 |
| 0x124103…423c22 | $2.2M | 0.00 |
| 0xab9e79…eb4d30 | $2.2M | 0.00 |
| 0x9de1a4…e840ff | $2.0M | 0.00 |
Latest transfers out of the attacker wallets
| When | Coin | Amount | Value then | To |
|---|---|---|---|---|
| 2023-02-13 3 years ago |
ETH | 44.88 | $68K | Contract |
| 2023-02-13 3 years ago |
ETH | 168.86 | $256K | Contract |
| 2023-02-13 3 years ago |
ETH | 108.16 | $164K | Contract |
| 2023-02-13 3 years ago |
ETH | 178.09 | $270K | Contract |
| 2023-02-13 3 years ago |
ETH | 55.00 | $83K | Contract |
| 2023-02-13 3 years ago |
ETH | 195.04 | $296K | Contract |
| 2023-02-13 3 years ago |
ETH | 170.95 | $259K | Contract |
| 2023-01-14 3 years ago |
ETH | 1,000.00 | $1.4M | 0xf18e1b…b8998a |
| 2023-01-14 3 years ago |
ETH | 1,000.00 | $1.4M | 0x5e8ed9…c314b4 |
| 2023-01-14 3 years ago |
ETH | 499.99 | $725K | 0x5f2628…68c44a |
| 2023-01-14 3 years ago |
ETH | 653.99 | $948K | 0x190fa1…4f6fb4 |
| 2023-01-14 3 years ago |
ETH | 120.00 | $174K | HTX |
| 2023-01-14 3 years ago |
ETH | 1,284 | $1.9M | 0x9b2ba8…fa0767 |
| 2023-01-14 3 years ago |
ETH | 597.26 | $866K | Contract |
| 2023-01-14 3 years ago |
ETH | 597.55 | $866K | Contract |
| 2023-01-14 3 years ago |
ETH | 587.97 | $853K | 0xc5cf82…098b2b |
| 2023-01-14 3 years ago |
ETH | 597.03 | $866K | 0x87b07c…32c7b6 |
| 2023-01-14 3 years ago |
ETH | 596.84 | $865K | 0x3ee6a0…563bcf |
| 2023-01-14 3 years ago |
ETH | 1,000 | $1.4M | 0xebfd85…211d9f |
| 2023-01-14 3 years ago |
ETH | 257.00 | $373K | HTX |
| 2023-01-14 3 years ago |
ETH | 1,500 | $2.2M | 0xebfd85…211d9f |
| 2023-01-14 3 years ago |
ETH | 268.00 | $389K | 0x09c964…93b2f5 |
| 2023-01-14 3 years ago |
ETH | 290.00 | $420K | HTX |
| 2023-01-14 3 years ago |
ETH | 160.00 | $232K | 0x880faa…1853e1 |
| 2023-01-14 3 years ago |
ETH | 596.97 | $866K | 0x4b2eb3…b83b28 |
| 2023-01-14 3 years ago |
ETH | 597.37 | $866K | 0x36f460…125434 |
| 2023-01-14 3 years ago |
ETH | 597.21 | $866K | 0x6f21b7…ba088a |
| 2023-01-14 3 years ago |
ETH | 597.13 | $866K | 0xa2f715…a24ee9 |
| 2023-01-14 3 years ago |
ETH | 200.00 | $290K | 0xc9416d…9a5bf1 |
| 2023-01-14 3 years ago |
ETH | 744.99 | $1.1M | 0xc9416d…9a5bf1 |
What the attacker wallets still hold
| Coin | Amount | Value now |
|---|---|---|
| ETH | 160.19 | $373K |
Stablecoins are valued at $1 even if the issuer has frozen them.
Tagged attacker wallets (70)
| Etherscan tag | ETH now |
|---|---|
| Harmony Bridge Hacker 401 | 160.00 |
| Harmony Bridge Hacker 10 | 0.03 |
| Harmony Bridge Hacker 5 | 0.02 |
| Harmony Bridge Hacker 21 | 0.02 |
| Harmony Bridge Hacker 11 | 0.02 |
| Harmony Bridge Hacker 4 | 0.02 |
| Harmony Bridge Hacker 2 | 0.02 |
| Harmony Bridge Hacker 20 | 0.01 |
| Harmony Bridge Hacker 102 | 0.01 |
| Harmony Bridge Hacker 51 | 0.01 |
| Harmony Bridge Hacker 53 | 0.01 |
| Harmony Bridge Hacker 3 | 0.01 |
| Harmony Bridge Hacker 402 | 0.00 |
| Harmony Bridge Hacker 403 | 0.00 |
| Harmony Bridge Hacker 30 | 0.00 |
| Harmony Bridge Hacker 103 | 0.00 |
| Harmony Bridge Hacker 105 | 0.00 |
| Harmony Bridge Hacker 31 | 0.00 |
| Harmony Bridge Hacker 100 | 0.00 |
| Harmony Bridge Hacker 41 | 0.00 |
| Harmony Bridge Hacker 201 | 0.00 |
| Harmony Bridge Hacker 203 | 0.00 |
| Harmony Bridge Hacker 40 | 0.00 |
| Harmony Bridge Hacker 302 | 0.00 |
| Harmony Bridge Hacker 304 | 0.00 |
Showing the 25 largest of 70; all are included in the totals.
The Etherscan-tagged wallets for this hack first moved funds in January 2023, months after the theft.
Hack date, amount and method: DefiLlama hacks database. Attacker wallets: public Etherscan tags. Transfers read from the Ethereum blockchain, last updated 2026-10-27 12:39 UTC. Only ETH and tracked tokens are valued; transfers under $10K are left out. Information only. We don’t recover funds or identify people.
Questions
Where did the stolen Harmony Bridge funds go?
From the 70 wallets Etherscan tags as the Harmony Bridge attacker, we see $65.1M to plain wallets, $11.0M to exchanges, $8.3M to contracts (swap services, bridges, other apps). Most funds pass through further wallets after the first hop, so this shows the first step only.
How much is still in the Harmony Bridge attacker wallets?
About $373K in ETH and tracked tokens, read from the blockchain on 2026-10-27T12:39 UTC.
How much was stolen in the Harmony Bridge hack?
DefiLlama's hacks database records about $100.0M lost on 2022-06-23 (validator key compromise).
Does Deep Blue Alpha recover stolen funds?
No. We show public on-chain transfers from wallets that Etherscan has tagged. We don't trace funds beyond what is shown, recover assets, or identify people.
