Harmony's ONE token fell about 26 percent in Asian morning hours on Wednesday after an apparent exploit created roughly 4 billion new tokens, an amount equal to more than a quarter of the token's existing supply. The dramatic price collapse underscores the vulnerability of smaller blockchain networks to supply-manipulation attacks.
Harmony confirmed the attack and said it is working with exchanges to freeze the funds and preparing a software fix. The team added that it is exploring rollback options, a controversial measure that would return the network to a state before the exploit and effectively remove transactions that occurred afterward from the blockchain's accepted history.
The Scale of the Damage
Roughly 15 billion ONE tokens existed before the incident, meaning the 4 billion newly created tokens represent a sudden increase of about 26 percent against that supply. Such a massive dilution would normally take years of inflation to achieve through legitimate staking rewards. The attacker accomplished it in a single exploit, potentially flooding the market with unbacked tokens and crashing the price.
The Harmony team has not yet explained the specific vulnerability, how the 4 billion figure was calculated, or how far back any proposed rollback would go. The lack of clarity has left holders in limbo, with exchanges likely to halt trading until the situation is resolved.
The Rollback Dilemma
A potential rollback by Harmony would mean returning the network to a state before the exploit and continuing from that point. That can prevent an attacker from keeping newly created tokens still on the network, but it becomes harder once funds have reached exchanges or moved onto other systems.
Many in the industry view a rollback as antithetical to blockchain's core principle of immutability. The debate echoes the controversy surrounding the Ravencoin rollback crisis just a day earlier, where miners moved to rebuild the chain from before a software flaw, putting several days of legitimate transactions at risk of reversal.
A History of Security Issues
Harmony has dealt with unauthorized creation of ONE before. In December 2023, a bug in its staking system caused about 146.3 million ONE to be created when tokens that should have stopped receiving payouts continued to receive them. The network responded with an emergency software update and blacklisted addresses holding the improperly created tokens.
Harmony was also hit by one of crypto's biggest bridge attacks in 2022, when approximately $100 million was stolen from its Horizon bridge after attackers compromised private keys controlling it. The attack was later attributed to a state-sponsored hacking group.
What Comes Next
Wednesday's incident appears different from previous Harmony exploits because the reported damage involves the creation of ONE on Harmony's own chain rather than assets being stolen from a bridge. This means the attack struck at the core of the network's tokenomics rather than a peripheral protocol.
The incident adds to a growing list of security concerns across smaller blockchain networks. From 85 critical bugs flagged by Bitcoin developers to the Ravencoin rollback, the crypto industry continues to grapple with the trade-offs between decentralization, security, and the ability to respond to exploits without undermining the fundamental promise of immutability.
For Harmony, the immediate priority is containing the damage. Working with exchanges to freeze the newly minted tokens is the first line of defense, but if the funds have already been dispersed across multiple platforms, recovery becomes significantly more difficult. The team has promised another update when more information is available.
For more crypto news and security analysis, visit Bitnxt.io.
