Harmony plans rollback after attack created 3 trillion ONE

Harmony plans to roll its blockchain back to August 11 after an attacker created more than three trillion ONE tokens without authorization.

The rollback would erase the forged coins, but it will come at a cost, because transactions that are legitimate and that were completed after the chosen recovery point would also disappear.

This means exchanges, bridges, and users will have to retrace these transactions that happened during that period.

Harmony chooses rollback despite the disruption

The team wants to return its two affected shards to their state at 23:25:37 UTC on August 11, which is seconds before the first confirmed unauthorized mints.

Harmony reviewed 141,628 blocks from the affected period on Shard 0 alone, and they contained 109,126 regular transactions and another 315 staking transactions. All of these would be erased under the plan, but the team looked at less disruptive alternatives, including destroying selected balances and blocking wallets.

But the unauthorized coins that were produced had already spread into exchanges, bridges, liquidity pools, and wallets containing other users’ funds. If the team tries to remove only the attacker’s coins, it could affect innocent users or leave some forged ones behind.

Harmony also said it cannot automatically recreate legitimate transactions. It said once the network returns to its former state, transactions might not produce the same results, as balances and other things might have changed.

Attack created more ONE than first reported

Harmony’s investigation found that the attacker manipulated records of previously completed transfers between parts of the network, and this allowed old transactions to appear unused and be processed again.

The result of this was that new ONE coins were created without removing an equivalent amount elsewhere.

Harmony said about six forged transactions created about 3.01 trillion ONE across four wallets, which was higher than the four billion ONE that was reported earlier, which Harmony said represented only the first wave it identified.

One wallet later attempted 534 transfers in just 106 seconds, and 477 succeeded in the transfers, moving about 2.385 trillion ONE.

Harmony has not been able to recover the assets, but it has traced most of the movement to wallets or services.

ONE price remains under pressure

ONE traded near $0.00072 on August 18, roughly 42% below its pre-incident level around $0.00125, with it briefly approaching $0.00060 during the heaviest selling.

ONE was already trending lower before the attack. However, the latest fall accelerated as details of the unauthorized mint emerged and Harmony moved towards a rollback. Trading also increased when the price dropped, showing that the sell-off attracted more market activity.

Final Summary

Harmony plans to erase approximately 3.01 trillion forged ONE by returning the network to its state before the attack.
The rollback would also remove legitimate transactions completed after the recovery point, creating additional work for users and services.