Summary

• Holograph experienced a security breach on June 13, 2024, resulting in the protocol’s native token, HLG, falling by 79.4% in value (~$110M loss in FDV).
• The exploit was due to unauthorized admin access of a proxy wallet by a disgruntled former contractor who minted approximately $14 million worth of new HLG and sold it on the open market, crashing the price.
• Working alongside security firm Halborn, Holograph successfully identified the root cause of the exploit and implemented a comprehensive resolution including operational risk controls to prevent the incident from ever happening again.
• Bridging has been re-enabled and the HLG max supply will return to 10 billion through a final series of burns.

Incident Cause

In January, Holograph upgraded to Holograph Protocol V2. The HolographOperator V2 contract had a reference to the Holograph Protocol LayerZero V1 proxy contract 0x777C1. The admin of the proxy contract was the 0xC0ffee wallet, which was managed by a disgruntled former contractor who had previously worked on Holograph Protocol V1. In April and May, he used his admin access to upgrade the contract and add malicious jobs to Holograph Protocol V2. In May, the HolographOperator contract was upgraded to remove the 0x777C1 contract from Holograph Protocol V2. The malicious jobs were kept hidden until June 13, when they were executed by the 0xC0ffee and acc01ade.eth wallets.

Incident Timeline

On June 13 at 8:32 AM UTC, a malicious job was executed on Mantle by the 0xC0ffee wallet. The payload masqueraded as a valid job and minted 10 billion HLG in a bridge transaction. The wallet then constructed several bridge jobs to other networks in an effort to hide the HLG. At 9:20 AM UTC, the 0xC0ffee wallet created a bridge transaction from Mantle to Ethereum for 1 billion HLG. On Ethereum, the malicious actor manually called the executeJob function on the HolographOperator contract. The job failed to execute because of invalid gas parameters. Eight minutes later, the malicious actor called the recoverJob function, which minted 1 billion HLG on Ethereum. From there, HLG was transferred to various centralized exchanges and aggressively sold.

1. April 2024 - Several malicious jobs were created to mint hETH, hMATIC, hAVAX, and hMNT.
2. May 2024 - Several malicious jobs were created to mint HLG.
3. May 2024 - The 0x777C1 contract was removed from the HolographOperator V2 contract.
4. June 2024 - acc01ade.eth executed one of the HLG bridge jobs on Ethereum and transferred the HLG to exchanges.
5. June 2024 - Bridging was disabled and the recoverJob function was removed.
6. June 2024 - All malicious jobs were deleted.

Malicious Jobs

Exchange Deposits

The malicious actor deposited 1 billion HLG into 5 centralized exchanges (Bybit, Gate, KuCoin, Bitget, and Backpack) and aggressively sold HLG until the malicious actor’s accounts were frozen. The malicious actor was able to successfully withdraw approximately $1.3 million in USDT and convert it into ETH. He then distributed the ETH across various wallets and mixers, which are currently being monitored. Approximately 200 million HLG was successfully frozen on centralized exchanges and is currently in the process of recovery through law enforcement procedures.