Holograph hack — June 2024

On 13 June 2024 someone with administrative access to Holograph Protocol's v1 contracts minted one billion HLG tokens through a proxy wallet and sold them into the open market. HLG fell sharply the same day: The Defiant recorded a drop of about 54 per cent, from roughly $0.014 to $0.0064, and CoinDesk put the fall at over 60 per cent.

The headline figure is disputed because it depends on which price is applied to the newly minted tokens. Holograph's own account, Cointelegraph and the subsequent law-enforcement case describe about $14.4 million of HLG minted, valuing the tokens at the pre-exploit price; BleepingComputer's report on the arrests used $14 million. CoinDesk valued the same one billion tokens at slightly more than $6.7 million and The Defiant at about $6.4 million, using prices after the market had already fallen. The amount the attacker actually realised in ETH and stablecoins has not been established in the sources used here, so the range spans the post-crash and pre-exploit valuations of the same one billion tokens.

Holograph published a post-mortem on 2 July 2024 after an investigation with security firm Halborn, saying a disgruntled former contractor with unauthorised admin access had planned the exploit months in advance. On-chain analysis linked the wallet acc01ade.eth, whose operator had contributed code to the project, to the exploit; CMT Digital analyst Matt Casto suggested on the day that the culprit was a rogue developer who had funded the address 26 days earlier. Holograph patched the contract and worked with exchanges on the stolen funds.

In August 2024 Italy's Polizia di Stato, working with the French National Police, arrested two suspects in Salerno; two others were investigated but not arrested. Police seized wallet private keys and electronic devices. No conviction has been reported.