Harmony chain exploited (again)

[noorman0]

Summary of latest incident:

• An exploit enabled the unauthorized minting of approximately 4 billion ONE tokens (roughly 26% of the previous total supply of around 15 billion).
• The tokens were created via empty blocks, specifically by exploiting vulnerabilities in receipt verification and signature checks related to sharding.
• Approximately 2.8 billion ONE were quickly moved to exchanges.
• The Harmony team has confirmed the incident and is working with exchanges to freeze funds, has released an emergency patch v2026.1.1 for validators (to prevent further minting), has halted the bridge, and is considering a blockchain rollback.

Sources: [1], [2]
Following this incident, the price of ONE dropped by -35%. It is worth noting that Harmony has experienced serious issues several times over the past 4 years; a similar incident occurred in 2023, when approximately 146M native coins ONE were illicitly minted due to a bug in the staking system.

[OmegaStarScream]

Sad to see, but was there anyone using the project prior to this second exploit? Both the chain's stats[1] as well as the trading volume on CMC show that there was barely any userbase, project really died with the first incident.

And looking at the DEXes stats, I would imagine those numbers were caused by the hacker's swapping a decent amount of money already, if not all so I doubt a rollback would help in much at this point.

[1] https://defillama.com/chain/harmony

[_act_]

This kind of exploits have become very common now. Also there has been attack on Raven and also there is a bridge attack to steal XRP recently which was successful. Almost every week, new exploits. These let us know that there are a lot of things that should not exist in crypto that are existing today.

[Orpichukwu]

Sad to see, but was there anyone using the project prior to this second exploit? Both the chain's stats[1] as well as the trading volume on CMC show that there was barely any userbase, project really died with the first incident.

They lost the majority of their supporters after their last exploit, but some people still remain. No matter how a project is, there are still those who will still stick with them and expect a breakthrough. On their X page, followers are already saying they lack all it takes to handle Harmony, and there are more possibilities that it’s an inside job than an external attack.

And looking at the DEXes stats, I would imagine those numbers were caused by the hacker's swapping a decent amount of money already, if not all so I doubt a rollback would help in much at this point.

[1] https://defillama.com/chain/harmony

If the majority of the unauthorised minted tokens have been sold, what addresses are they asking exchanges to block? And if the funds were not moved to a CEX (which I doubt any hacker would even be foolish enough to do), it will be hard to block all the addresses that have the difference between the DEX & CEX.

We traced 10288 transfers across all 409 wallets where the fraudulently minted tokens have landed, and alerted exchange partners on hundreds of suspicious deposit transactions. They promptly blocked the hacker’s wallets.

https://x.com/i/status/2087487246148542527

[hugeblack]

How could any of the auditors have missed this? The network generates 441 million new ONE tokens annually, yet nearly 4 billion ONE tokens were minted and 2.8 billion ONE tokens were transferred to trading platforms.

This raises serious questions about the security of these tokens.

[JeromeTash]

I don't know if it's just me, but the hacks are becoming so rampant at the time when the different AI models are on a race to be at the top. I think the AI tools are making the job of hackers or bad actors much easier and much firster to identify exploits

These kinds of exploits were not so common some 3-4-5 years back, but now every passing them, you get to see these stories more and more.

[Taskford]

How could any of the auditors have missed this? The network generates 441 million new ONE tokens annually, yet nearly 4 billion ONE tokens were minted and 2.8 billion ONE tokens were transferred to trading platforms.

This raises serious questions about the security of these tokens.

Its pretty clear that they are not doing their job, it seems that there's no one monitoring the system that's why that exploit happened again. Now that situation happened on Harmony seriously raise question about how secured their token.

The latest one is something big which they could easily notice if the dev is not neglect their responsibilities.

It made me think that maybe there's inside job happened in this recent, but hopefully I'm wrong.

Now this is their counter measures done after that exploit happened to them https://coin360.com/news/harmony-one-unauthorized-mint-emergency-patch

[asriloni]

How could any of the auditors have missed this? The network generates 441 million new ONE tokens annually, yet nearly 4 billion ONE tokens were minted and 2.8 billion ONE tokens were transferred to trading platforms.

This raises serious questions about the security of these tokens.

During Hamony's previous hack (Bridge exploit by DPRK). Some people helped them(include Zach), but the dev gives no reward for people for their help and they only said good job those who helped them.

Beside that they ever created bug bounty, but they also refused to pay anyone who found the bugs for them. Harmony team was a scammer, and simply didn't care to their blockchain.

No doubt no auditors had interest to work with them.

[TastyChillySauce00]

How could any of the auditors have missed this? The network generates 441 million new ONE tokens annually, yet nearly 4 billion ONE tokens were minted and 2.8 billion ONE tokens were transferred to trading platforms.

This raises serious questions about the security of these tokens.

Audit is only code review at one point-in-time like a snapshot, no guarantee of security as the project evolve and they added more features. However, even if a project don't change the code at all and stick to the past audit, it's no guarantee that there is no security exploit. Maybe there was new vulnerabilities not yet known when the audit takes place and the auditor certainly doesn't check against that possibility, Harmony latest audit was in 2021.

I think after the 2022 bridge exploit they haven't commissioned a new third party audit, which is a big flaw. If their protocol got hacked, it should make them think about reviewing the whole protocol before fully operating again. Even better they should've re audited their code again after 2 years at minimum since their code doesn't seem to have the best security.

[hugeblack]

During Hamony's previous hack (Bridge exploit by DPRK). Some people helped them(include Zach), but the dev gives no reward for people for their help and they only said good job those who helped them.

Beside that they ever created bug bounty, but they also refused to pay anyone who found the bugs for them. Harmony team was a scammer, and simply didn't care to their blockchain.

It would be laughable if investors trusted them again, and another Harmony Chain exploit is surely only a matter of time.

I think these developers are preoccupied with launching as many projects as possible, and they don't care what happens afterward.

[$crypto$]

This kind of exploits have become very common now. Also there has been attack on Raven and also there is a bridge attack to steal XRP recently which was successful. Almost every week, new exploits. These let us know that there are a lot of things that should not exist in crypto that are existing today.

So far this year more than 100+ crypto projects have been exploited with total losses of maybe billions of dollars, even we consider it almost not strange, there are always gaps where hackers can exploit these vulnerabilities.

https://monitoringroom.com/situation/crypto-hack

During Hamony's previous hack (Bridge exploit by DPRK). Some people helped them(include Zach), but the dev gives no reward for people for their help and they only said good job those who helped them.

Beside that they ever created bug bounty, but they also refused to pay anyone who found the bugs for them. Harmony team was a scammer, and simply didn't care to their blockchain.

No doubt no auditors had interest to work with them.

Those who help onchain activities with resources that are given only in return for "good work"? Team Harmony already clearly does not appreciate the efforts of others who all the time spend to keep track of her.

If there is a bug bounty that is not paid, it is likely that the analysts will no longer want to help.

[Taskford]

During Hamony's previous hack (Bridge exploit by DPRK). Some people helped them(include Zach), but the dev gives no reward for people for their help and they only said good job those who helped them.

Beside that they ever created bug bounty, but they also refused to pay anyone who found the bugs for them. Harmony team was a scammer, and simply didn't care to their blockchain.

It would be laughable if investors trusted them again, and another Harmony Chain exploit is surely only a matter of time.

I think these developers are preoccupied with launching as many projects as possible, and they don't care what happens afterward.

And they always prove doing same pattern which launching non stop new project. But both execution and site protection is truly so weak that's why to many exploits happen to them.

Seeing them operating like that does not surprise us that they might get experience more same like issues.

Also after that 4B mint happen I cannot blame people or the investor to lose site on their project. Much better for investor to avoid them or they might suffer again another exploit in future.

[dwyane36]

So far this year more than 100+ crypto projects have been exploited with total losses of maybe billions of dollars, even we consider it almost not strange, there are always gaps where hackers can exploit these vulnerabilities.

Well, if the statistics are to be believed, hackers have become quite active since the beginning of this year, and this was especially noticeable in the spring. To be more precise, from January to the present, there have already been at least 175 different hacks, resulting in damages exceeding $1.2 billion. Either hackers have become too sophisticated, or the developers of many projects have become more irresponsible when it comes to security.

[Dr.Bitcoin_Strange]

I think some project's team are just careless about their project because these  4 billions ONE token that was minted by the scammers is roughly about 1 quarter of the token's current supply, so how come the team could not have observed this early enough even before the scammer starts moving the coins to exchange to trade them. There were many exploit that happened last month, Lien Finance lost $542k to a hacker's exploit, same as AFX Trade that lost $24 M after bridge keys were compromised, it went on and on cuz I saw about 6 news relating to different exploit that happened last month but I didn't go through them all. We really have to be more careful in protecting our asset because the rate at which these scammers are targeting companies and succeed in their hack is quite alarming, they can easily get through to some investors that have been careless with their security.