Harmony’s ONE Tumbles 40% Following Suspected Attack and Massive Token Creation

Harmony’s ONE Tumbles 40% After Exploit Appears to Mint 4B Tokens

Harmony’s ONE token plunged about 40% in Asian trading Wednesday after a suspected exploit apparently created roughly 4 billion new tokens, equal to more than one-quarter of the supply that existed before the attack.

Harmony confirmed the incident and said it is working with network operators on an emergency software update intended to prevent further unauthorized token creation. The team is also determining what steps to take regarding the tokens already minted.

The blockchain has temporarily suspended its token bridge and requested that cryptocurrency exchanges freeze funds associated with four wallets believed to be connected to the exploit.

Harmony said it is preparing a patch and reviewing potential rollback solutions. The project plans to provide additional details once more information becomes available.

Exploit Could Increase ONE Supply by 26%

Harmony is a layer-1 blockchain built for decentralized finance applications and digital marketplaces. Its native ONE token is used to pay transaction fees and support network security.

The project reached a market capitalization of roughly $4 billion in January 2022.

Around 15 billion ONE tokens existed before the latest incident. If the reported 4 billion tokens were all created during the exploit, they would represent an increase of about 26% over the previous supply.

Such a sharp increase in supply can weigh heavily on a token’s price, particularly if the newly created coins are sold or transferred to exchanges.

Rollback Could Reverse the Attack

Harmony is considering a possible rollback that would restore the blockchain to a point before the exploit took place.

A rollback could remove transactions recorded after the attack and potentially prevent the attacker from keeping the newly minted tokens. However, the process becomes more complicated if the funds have already been transferred to exchanges or moved across other networks.

The proposal also raises concerns about blockchain immutability. Reverting the network could undo legitimate transactions that occurred after the exploit, affecting users who were not involved in the attack.

A similar dilemma recently emerged on Ravencoin, a smaller blockchain based on Bitcoin’s code, after portions of its network accepted invalid blocks. Miners considered rebuilding the chain from an earlier point, potentially reversing several days of activity.

Although the incidents are unrelated, both cases highlight the tension between restoring a blockchain after an attack and preserving its transaction history.

Previous ONE Issuance Problem

Harmony has encountered unauthorized ONE creation in the past.

In December 2023, a staking-system bug generated about 146.3 million ONE after certain tokens continued receiving rewards despite being ineligible.

Harmony reported that 74 addresses were involved, including one wallet that received roughly 51.2 million ONE. Around 16.4 million of the affected tokens were later transferred to an exchange.

The project responded by releasing an emergency update and blacklisting addresses holding the improperly generated tokens.

Harmony also suffered a major security breach in 2022 when attackers stole approximately $100 million from its Horizon bridge after compromising the private keys controlling the system. The FBI later linked the attack to North Korea’s Lazarus Group.

The latest incident appears to be different, as the reported losses involve unauthorized creation of ONE directly on the blockchain rather than the theft of existing assets from the bridge.

Harmony has yet to explain how the attacker was able to mint the tokens, independently confirm the reported 4 billion issuance or reveal how it plans to handle the newly created ONE already circulating in the market.