Harmony's ONE Sinks 37% After Attacker Mints 4 Billion Tokens

Layer-1 blockchain Harmony has confirmed it was exploited after an attacker minted roughly 4 billion ONE tokens without authorisation, sending the token down 37% to about $0.00077, per CoinGecko data.

On-chain analyst Juiceberg flagged the mint early Wednesday, putting it at close to 4 billion tokens, or about 26% of the supply, and saying the tokens had been created through empty blocks. Around 2.8 billion were funnelled onto exchanges as the price fell.

In a follow-up tweet, the analyst said the attacker had roughly 115 million ONE left to sell on-chain, about 2.9% of the total minted. “The overwhelming majority (~97%) is already on exchanges,” Juiceberg wrote, and had either been sold or was sitting in deposit wallets.

Harmony responded in a tweet that it was “working with our team and appropriate exchanges to stop and freeze the funds,” adding that it was preparing a patch and weighing rollback options. In a second post it named four wallets, each listed in both Harmony and hex formats, and asked exchanges to block anything traced to them.

Just over two hours after that first statement it paused its bridge, then released a patch a minute later, telling validators to upgrade to a build it said prevents any further minting. Dealing with the tokens already created would take another update, it said. Five hours had passed since Juiceberg’s first post.

The project has not disclosed the vulnerability, confirmed how many tokens were created, or said how much reached exchanges. One oddity Juiceberg noted is that Harmony’s totalSupply endpoint did not reflect the new tokens, and price trackers still list circulating supply at about 14.87 billion.

Rolling back the chain

A rollback would return the network to a state before the exploit and continue from there, erasing what followed from the accepted history. That cuts both ways, since transactions made by ordinary users after the attack would go with it.

Harmony has been here before, with hackers draining about $100 million from its Horizon cross-chain bridge in June 2022, in an attack the FBI later attributed to North Korea’s Lazarus Group.

The project’s first proposal to the 2022 hack was to reimburse victims in ONE, which would have meant minting billions of new tokens on top of the circulating supply and hard-forking the chain to allow it. The plan drew enough criticism that the team replaced it with one funded from its treasury. Four years on, an attacker has minted a comparable amount without asking.

ONE now carries a market capitalisation of about $11.5 million, ranking it outside the top 1,000 tokens. It last traded near its October 2021 record of $0.38 more than four years ago, and is down more than 99% from that level.