Harmony confirms unauthorized minting of 4 billion ONE; bridge paused, validators told to upgrade, rollback on the table
Attacker used the empty-block mechanism to trigger the mint (~26% of supply) while the totalSupply endpoint failed to reflect it; ~2.8B ONE routed toward exchanges before Harmony patched roughly two hours after the flag. Team has asked exchanges to freeze four attacker wallets.
Two failures stacked: a minting bug AND broken supply reporting. Any dashboard that trusts a chain's own totalSupply endpoint for risk monitoring just got a live counterexample.
