HECO Bridge was exploited when the attacker used the Heco Bridge Operator to call withdrawToken and remove ETH and ERC-20 assets, then swapped tokens for ETH and distributed proceeds across multiple wallets. Linked blockchain-intelligence reporting attributed the HECO and HTX thefts to North Korea's Lazarus Group based on attributes of the hack and subsequent fund movements, including later laundering through Tornado Cash.