Compass Investments

Harmony plans to roll back its blockchain network to the state prior to last weeks attack after discovering that more than 3 trillion ONE tokens had been illegally created.

The Layer 1 blockchain stated in its latest incident report that validators will roll back Shard 0 and Shard 1the two chains that make up its sharded network to the point in time immediately preceding the confirmed fraudulent issuance. All blocks and transactions executed after that point will be removed.

Harmony noted that it had considered various options, such as burning tokens, blacklisting affected wallets, or even migrating the ONE (ONE), but concluded that a rollback is the fairest and safest solution.

Of all the options we explored, a fixed rollback window is the fairest and safest, Harmony stated. It applies a single rule to everyone, eliminates the false state, and carries the lowest risk of a replay attack or consensus failure.

Harmony first confirmed the exploit on August 12 after detecting unauthorized minting of ONE tokens. An independent researcher initially identified 4 billion tokens created via empty blocks, but Harmony later determined that this was only the first wave.

A subsequent investigation revealed that 3.01 trillion ONE were forged in six transactions and sent to four attacker wallets.

One of these wallets successfully transferred nearly 2.4 trillion ONE in less than two minutes; at pre-attack prices, these tokens were worth nearly $3 billion.

Harmony reported that it traced nearly all of the counterfeit tokens to wallets or services, although many of them passed through DEX pools and bridges, making it difficult to safely return or burn them without harming innocent users.

According to available information, the vulnerability was related to a flaw in the cross-shard receipt verification mechanism, which allowed valid receipts to be processed multiple times, enabling attackers to create new ONE tokens without corresponding debits from other accounts. The vulnerability was fixed on August 12, when the attack was first detected.”,”detected_source_language”:”RU