Harmony's ONE token dropped 37% early Wednesday after an attacker exploited the network to mint roughly 4 billion unauthorized tokens — about 26% of the entire circulating supply — and rushed most of them onto exchanges before the team could respond. The token fell to around $0.00077, according to CoinGecko data, pushing Harmony's market capitalization down to roughly $11.5 million and leaving it outside the top 1,000 cryptocurrencies by size.
Of the 4 billion tokens created, approximately 2.8 billion — about 97% of the total — were transferred to exchanges, presumably to be sold before the market could react. Only around 115 million tokens, roughly 2.9% of the mint, remained on-chain, giving the attacker a comparatively small direct war chest once exchanges moved to freeze what they could.
A Five-Hour Scramble
The response moved fast by blockchain-incident standards. An analyst using the handle Juiceberg flagged the unauthorized mint early Wednesday morning. Harmony paused its bridge roughly two hours later, and released a patch closing the minting vulnerability just a minute after that — a five-hour span from initial discovery to a deployed fix. The team said in a statement it was “working with our team and appropriate exchanges to stop and freeze the funds,” and separately asked exchanges to block four specific wallet addresses tied to the attacker, provided in both hex and Harmony address formats.
A Rollback Would Come at a Cost
Harmony is now weighing a full network rollback to erase the exploit, an option that would restore the chain to its pre-attack state but would also undo every legitimate transaction processed since the mint occurred — a tradeoff that has divided validator communities in past blockchain incidents, since it protects victims of the exploit at the expense of anyone who transacted normally in the meantime.
Related: Harmony Blockchain Hit by Unauthorized Mint of 4 Billion ONE Tokens
A Second Strike for Harmony
This isn't Harmony's first brush with a major security failure. The network's Horizon Bridge was drained of roughly $100 million in June 2022, an attack the FBI later formally attributed to North Korea's Lazarus Group, part of the same TraderTraitor campaign the bureau has linked to a string of other cross-chain bridge exploits. ONE has never recovered from that episode, trading down more than 99% from its October 2021 peak of $0.38 even before this week's unauthorized mint. Whether or not Harmony pulls the trigger on a rollback, the network's ability to attract new activity now looks harder than ever with its token capitalization down to eight figures.
