Bitcoin.com News reported that Harmony Protocol's ONE token plunged more than 30% on Wednesday, August 12, reaching an all-time low, after an exploit that allowed an attacker to mint more than 4 billion tokens, about 26% of the network's total supply.
On-chain data shared by researcher Juiceberg shows that the attacker transferred about 97% of the fraudulently minted tokens directly to cryptocurrency exchanges, leaving approximately 115 million tokens in the issuance addresses. ONE's market capitalization shrank from nearly US$16 million to US$11.7 million, indicating that a significant portion of the illicit tokens was liquidated.
Harmony's response
The Harmony team confirmed the exploit and asked exchanges to immediately freeze funds linked to four main attacker wallets. The protocol also paused the main bridge interface and released an urgent code patch, instructing all validators to update to prevent new issuance.
"All validators, please update. The patch prevents any new issuance. We will proceed with another update to handle tokens already issued," the team said in an announcement. The team added that it is evaluating additional measures, including a possible network rollback.
History of attacks
ONE reached US$0.379 in early 2022, before the project lost US$100 million in an attack on the Horizon bridge. At the time, the Lazarus group, linked to North Korea, allegedly exploited compromised private keys in hot wallets responsible for processing cross-chain transactions.
With the new validator-level issuance vulnerability, the token has retreated about 97% from its peak. Security researcher ZachXBT said he will not track the incident and that no one should help Harmony for free, citing the lack of rewards for white-hats and researchers during the 2022 attack.
"I won't track this incident and I think no one should help them for free. Harmony took advantage of the people who helped during the US$100 million Harmony Bridge attack by North Korea in 2022 and rewarded US$0 for significant freezes that led to seizures by authorities, and simply said 'good job'," ZachXBT said.
