Harmony’s ONE Token Plunges 40% After Suspected Attack Creates Massive New Supply

Harmony’s ONE Token Plunges After Suspected Supply-Minting Exploit

Harmony’s ONE token dropped about 40% during Asian morning trading Wednesday after an apparent exploit resulted in roughly 4 billion additional tokens being created, equivalent to more than one-quarter of the supply that existed before the incident.

Harmony confirmed the attack and said it is coordinating with network operators to deploy an emergency software update designed to stop any further unauthorized minting. The project is also examining options for addressing the tokens that have already been created.

As part of its response, Harmony suspended its token bridge and asked cryptocurrency exchanges to freeze funds associated with four wallets linked to the incident.

The project said it is developing a patch and evaluating possible rollback measures, with another update expected as more details become available.

Exploit Adds About 26% to Existing ONE Supply

Harmony is a layer-1 blockchain designed to support decentralized finance applications and marketplaces. Its native ONE token is used for network transactions and helps secure the blockchain.

The project was once among the larger crypto networks by market value, reaching approximately $4 billion in January 2022.

Before the latest incident, around 15 billion ONE tokens were in circulation. The reported creation of another 4 billion tokens therefore represents an increase of roughly 26% relative to the previous supply.

A sudden expansion of that size can put substantial downward pressure on a token, particularly if newly created coins are sold or transferred to exchanges.

Harmony Considers a Possible Rollback

One option being considered by Harmony is a blockchain rollback, which would restore the network to a point before the exploit and continue from that earlier state.

Such a move could effectively remove transactions recorded after the attack from the accepted chain history, potentially preventing the attacker from retaining newly minted tokens.

However, executing a rollback becomes increasingly complicated if the affected assets have already reached exchanges or moved onto other networks and services. It also raises a fundamental question for blockchain systems because reversing confirmed transactions conflicts with the principle of network immutability.

The Harmony incident comes just one day after Ravencoin, another smaller blockchain based on Bitcoin’s code, faced a separate issue that raised the possibility of reversing part of its chain.

In Ravencoin’s case, miners considered rebuilding the network from a point before invalid blocks were accepted, potentially reversing several days of transactions. Although the incidents are unrelated, both demonstrate the difficult trade-off between eliminating the effects of an attack and preserving legitimate transactions that occurred afterward.

Harmony Has Faced Token-Creation Issues Before

This is not the first time Harmony has dealt with unauthorized ONE issuance.

In December 2023, a problem involving the network’s staking system resulted in approximately 146.3 million ONE being created after tokens that should no longer have received rewards continued generating payouts.

Harmony said 74 addresses were involved, including one wallet that received approximately 51.2 million ONE. About 16.4 million of the improperly created tokens were later transferred to an exchange.

The network responded with an emergency software update and blacklisted addresses holding the affected tokens.

Harmony also suffered one of the crypto industry’s largest bridge exploits in 2022. Attackers stole approximately $100 million from its Horizon bridge after compromising the private keys controlling the system. The FBI later linked the attack to North Korea’s Lazarus Group.

The latest incident appears to be different because the reported losses stem from unauthorized creation of ONE directly on the Harmony network rather than the theft of assets from a bridge.

Harmony has yet to disclose exactly how the attacker managed to create the additional tokens, independently confirm the estimated 4 billion issuance or explain how it intends to handle the newly minted coins already circulating.

About The Author