The apparent exploit comes a day after Ravencoin, another smaller blockchain built from Bitcoin’s code, faced its own possible rollback after invalid blocks were accepted by parts of its network.
In that case, miners moved to rebuild the chain from before the flaw, putting several days of transactions at risk of reversal. Ravencoin is separate from Harmony, but the two incidents show the trade-off involved in a rollback — that undoing an attack can also undo legitimate transactions made after it.
Not the first hit
Harmony has dealt with unauthorized creation of ONE before.
In December 2023, a bug in its staking system caused about 146.3 million ONE to be created when tokens that should have stopped receiving payouts continued doing so. Harmony said at the time that 74 addresses were involved, with one receiving 51.2 million ONE and about 16.4 million subsequently moved to an exchange.
The network responded to that incident with an emergency software update and blacklisted addresses holding the improperly created tokens.
Harmony was also hit by one of crypto’s biggest bridge attacks in 2022, when about $100 million was stolen from its Horizon bridge after attackers compromised private keys controlling it. The FBI later attributed that theft to North Korea’s Lazarus Group.