Harmony's ONE token fell 26% after 4 billion new tokens were minted, prompting the platform to work with exchanges to secure funds and develop a fix.
The price of Harmony's native token, ONE, has dropped sharply by approximately 26% following an incident that led to the unauthorized minting of around 4 billion new tokens. This event increased the total supply of ONE by over 25%.
Collaboration with Exchanges Underway
In response to the situation, Harmony is actively working with cryptocurrency exchanges to freeze the affected funds and is developing a software patch to address the vulnerability. The company stated, "We are working on a patch and rollback options," and promised to provide further updates as more information becomes available.
Harmony's blockchain, designed for decentralized finance (DeFi) applications, relies on its token, ONE, for transaction fees and network security. Before the attack, the total supply of ONE stood at approximately 15 billion, making the new tokens a significant and sudden increase.
The proposed rollback aims to revert the blockchain to its state prior to the attack, potentially excluding any transactions that occurred afterward. However, executing such a rollback can be complicated if the new tokens have already been transferred to exchanges or other platforms. Industry experts point out that this could undermine the core principle of immutability that blockchain technology is built upon.
This incident follows closely on the heels of a similar exploit involving Ravencoin, which also faced challenges related to invalid blocks just a day prior.
Past Vulnerabilities
This is not the first time Harmony has encountered issues with unauthorized token creation. In December 2023, a flaw in its staking mechanism allowed for the creation of approximately 146.3 million ONE tokens when certain tokens continued to receive rewards improperly. This incident affected 74 addresses, with one account receiving 51.2 million ONE, of which around 16.4 million were later transferred to exchanges.
In response to that earlier incident, Harmony implemented an emergency software update and blacklisted the involved addresses. Furthermore, Harmony was previously targeted in a major attack in 2022 that resulted in the loss of about $100 million from its Horizon bridge, an incident linked to North Korea's Lazarus Group by the FBI.
Wednesday's attack is distinct, as it directly involves the unauthorized creation of ONE tokens, rather than theft from a bridge. Harmony has yet to clarify the specifics of the vulnerability or how the figure of 4 billion was arrived at, as well as the details surrounding the proposed rollback.
(This story is developing.)
