Harmony's ONE Sinks 37% After Attacker Mints 4 Billion Tokens

Just over two hours after that first statement it paused its bridge, then released a patch a minute later, telling validators to upgrade to a build it said prevents any further minting. Dealing with the tokens already created would take another update, it said. Five hours had passed since Juiceberg's first post.

The project has not disclosed the vulnerability, confirmed how many tokens were created, or said how much reached exchanges. One oddity Juiceberg noted is that Harmony's totalSupply endpoint did not reflect the new tokens, and price trackers still list circulating supply at about 14.87 billion.

Rolling back the chain

A rollback would return the network to a state before the exploit and continue from there, erasing what followed from the accepted history. That cuts both ways, since transactions made by ordinary users after the attack would go with it.

Harmony has been here before, with hackers draining about $100 million from its Horizon cross-chain bridge in June 2022, in an attack the FBI later attributed to North Korea's Lazarus Group.

The project's first proposal to the 2022 hack was to reimburse victims in ONE, which would have meant minting billions of new tokens on top of the circulating supply and hard-forking the chain to allow it. The plan drew enough criticism that the team replaced it with one funded from its treasury. Four years on, an attacker has minted a comparable amount without asking.

ONE now carries a market capitalisation of about $11.5 million, ranking it outside the top 1,000 tokens. It last traded near its October 2021 record of $0.38 more than four years ago, and is down more than 99% from that level.