Harmony confirms exploit after attacker mints 4 billion ONE tokens
Security & Exploits ·
The layer-1 network is exploring a rollback that would erase the theft but also wipe out every legitimate transaction since the breach.
Harmony has acknowledged that an unknown attacker created roughly 4 billion ONE tokens without permission, an amount equal to about 26% of the circulating supply, according to Decrypt. The token's price fell 37% to around $0.00077, pushing ONE to an all-time low, per CryptoPotato. Other outlets tracked a slightly different decline of 26%, as noted by CoinDesk.
An on-chain analyst identified as Juiceberg first flagged the abnormal minting, tracing the new tokens to empty blocks and estimating that about 97% of them had already moved onto exchanges, either sold or parked in deposit wallets. Roughly 115 million ONE, about 2.9% of the total minted, reportedly remained unsold on-chain. Harmony's own totalSupply endpoint did not reflect the newly created tokens, and public price trackers continued to show circulating supply at around 14.87 billion, leaving a discrepancy between reported figures and what analysts observed.
In response, Harmony said on X that it was working with its team and relevant exchanges to halt and freeze the affected funds, and that it was preparing both a software patch and rollback options. The team later published four wallet addresses in Harmony and hex formats, asking exchanges to block any transfers linked to them. About two hours after its initial statement, Harmony paused its bridge and shipped a patch instructing validators to upgrade, a move intended to stop further unauthorized minting, though the project said a separate fix would be needed to address the tokens already created.
A rollback, if implemented, would reset the chain to a point before the exploit, discarding all activity that followed, including transactions made by ordinary users unrelated to the attack. Harmony faced a similar dilemma after its Horizon bridge was drained of about $100 million in June 2022, an attack later attributed by the FBI to North Korea's Lazarus Group; a proposal at the time to mint new ONE to reimburse victims drew heavy criticism and was scrapped in favor of treasury funding.
ONE's market capitalization has fallen to about $11.5 million, placing it outside the top 1,000 tokens and more than 99% below its October 2021 high of $0.38. The vulnerability behind the mint has not been disclosed, and Harmony has not confirmed the exact number of tokens created or how many ultimately reached exchanges, leaving the scope of the breach and any rollback decision unresolved.