Harmony Protocol is facing a major security crisis after an apparent exploit allegedly created roughly 4 billion unauthorized ONE tokens, equivalent to approximately 26% of the cryptocurrency’s existing supply. The sudden supply increase sent ONE plunging as much as 40%, while Harmony began working with cryptocurrency exchanges to freeze attacker-linked funds, released an emergency software patch, paused its bridge interface, and said it was considering the controversial option of rolling back the blockchain to reverse the damage.
The exact mechanics and full financial impact remain under investigation. Onchain researcher Juiceberg initially identified the unauthorized mint and estimated that approximately 2.8 billion ONE was quickly routed toward exchanges. Harmony confirmed it was responding to an exploit and unauthorized funds but had not independently confirmed all of the researcher’s figures when the initial reports were published.
Nearly 4 Billion ONE Tokens Allegedly Created
Harmony had roughly 15 billion ONE in existence before the incident.
The alleged creation of another 4 billion tokens therefore represented an enormous and unexpected increase of approximately 26% to the previous supply.
For existing holders, unauthorized token creation presents an immediate economic threat. If billions of newly created ONE reach exchanges and are sold, existing holders face both significant dilution and enormous additional selling pressure.
According to Juiceberg’s analysis, the attacker allegedly created the tokens through empty blocks before moving a substantial portion toward exchanges.
ONE Price Collapses as Tokens Reach Exchanges
The market reacted violently.
ONE dropped approximately 40% during Asian trading hours, falling to a new all-time low as traders reacted to the sudden increase in supply. Trading activity also surged dramatically as the market attempted to price in the potential damage.
Juiceberg estimated that roughly 2.8 billion of the newly created ONE had already been routed to exchanges, while approximately 115 million remained available to sell onchain at one stage of the investigation.
Those figures were based on independent onchain analysis and had not been officially confirmed by Harmony at the time of reporting.
Harmony Asks Exchanges to Freeze Attacker Funds
Harmony quickly began coordinating with cryptocurrency exchanges in an attempt to prevent additional funds from being sold.
The project publicly identified four wallet addresses associated with the incident and asked exchanges to block and freeze funds traced back to them.
Harmony’s first public response came within hours of the initial reports. The project said it was working with its team and relevant exchanges to stop the movement of funds while investigating the incident.
The effectiveness of those freezes could become particularly important because blockchain transactions themselves cannot simply be reversed once the assets have been transferred to another network or successfully sold through an outside platform.
Emergency Patch Released to Stop Additional ONE Minting
Harmony also moved to prevent the attacker from creating additional tokens.
The project released an emergency core software update and instructed validators to immediately upgrade their nodes. The patch was designed to prevent any further unauthorized minting while developers determined what to do about the billions of ONE that had already been created.
Harmony also paused its main bridge interface as part of the emergency response.
Stopping additional token creation addresses the immediate vulnerability, but it does not automatically eliminate the unauthorized ONE already created.
That problem has pushed Harmony toward a much more controversial possibility.
Harmony Considers Rolling Back the Blockchain
Harmony confirmed that it was evaluating rollback options.
A blockchain rollback would effectively return Harmony to an earlier state before the exploit occurred, allowing the network to continue from that point while removing subsequent transactions from the accepted blockchain history.
In theory, that could eliminate some or all of the unauthorized ONE created during the attack.
In practice, the situation is considerably more complicated.
Any legitimate transactions occurring after the selected rollback point could also potentially be affected. Funds that have already reached centralized exchanges or moved outside Harmony’s blockchain create additional complications.
Rollback Raises Major Decentralization Questions
Rolling back a blockchain remains one of the most controversial responses available after a major exploit because immutability is one of blockchain technology’s foundational principles.
Transactions recorded and finalized on a decentralized blockchain are generally expected to remain permanent.
A rollback essentially asks network participants to collectively agree that extraordinary circumstances justify rewriting a portion of that history.
Supporters could argue that reversing an exploit protects users and prevents an attacker from benefiting from billions of fraudulently created tokens.
Critics could argue that if developers and validators can reverse blockchain history when something goes wrong, questions emerge about how immutable or decentralized the network actually is.
Harmony has said only that rollback options are being evaluated. It had not committed to executing one in the initial response.
Harmony Has Faced Major Security Problems Before
The latest incident is particularly damaging because Harmony has already experienced one of crypto’s most notorious bridge attacks.
In June 2022, hackers stole approximately $100 million from Harmony’s Horizon Bridge after compromising private keys controlling the cross-chain infrastructure.
The FBI later attributed the attack to North Korea’s Lazarus Group.
Harmony subsequently experienced another issue in 2023 involving a staking bug that improperly created approximately 146.3 million ONE.
The latest incident therefore adds another major security challenge for a blockchain that was once among the industry’s largest Layer 1 networks.
Harmony’s market capitalization reached approximately $4 billion in January 2022 before the ecosystem suffered years of declining activity and token value.
