Rocket has suspended deposits, withdrawals and trading after an attacker manipulated a dormant perpetual market and withdrew approximately $287,000 in positive PnL from the platform’s Bridge.

Rocket said in a Sept. 7 update on X that the security incident occurred at approximately 19:00 UTC on Sept. 5, when an attacker targeted an inactive perpetual market using a burner account.

The attacker placed orders at artificially inflated prices and traded against themselves, creating artificial profits in one account while pushing the burner account into bankruptcy. The profitable account subsequently withdrew around $287,000 from the Bridge, leaving the resulting loss to be socialized across the platform.

Rocket attack used self trading to create artificial profits

Instead of describing a smart contract vulnerability, Rocket’s initial account of the incident centered on the manipulation of a dormant perpetual market with limited activity.

Using a disposable account, the attacker was able to post orders at inflated prices before acting as both sides of the trades. Rocket said the transactions generated “fake profits” for one account while the burner account accumulated the corresponding losses and became insolvent.

The account showing positive PnL then withdrew approximately $287,000 through the Bridge before the activity was stopped.

Rocket has since paused all trading, deposits and withdrawals while its team investigates the incident. The project did not provide a timeline for restoring the affected services or disclose how many users were exposed to the socialized loss.

Blockchain security tracker SlowMist classified the incident as a price manipulation attack and recorded the loss at $287,000.

The method bears similarities to previous incidents in thin perpetual markets where traders have been able to manipulate prices or positions and transfer resulting losses to liquidity providers or other parts of a trading platform.

In March 2025, a trader targeted Hyperliquid’s thin JELLY market by opening a large short position while buying the token on decentralized exchanges. The activity drove JELLY’s price sharply higher and pushed the short toward liquidation, eventually transferring the position to Hyperliquid’s liquidity vault.

As crypto.news previously reported, Hyperliquid restricted the trader’s accounts to reduce-only mode before validators later voted to delist the JELLY perpetual market and settle outstanding positions.

A separate Hyperliquid incident in March 2025 saw its HLP vault absorb around $4 million in losses after a trader withdrew collateral from a highly leveraged Ether position before liquidation. Hyperliquid said at the time that the event was not a protocol exploit and subsequently changed leverage requirements for Bitcoin and Ether positions.

Rocket seeks to freeze the stolen $287,000

With platform operations suspended, Rocket said it is working with security firms and law enforcement agencies to investigate the attack and recover the funds.

The team is coordinating with cryptocurrency exchanges, cross-chain bridges and stablecoin issuers to trace the stolen assets and attempt to freeze them. Rocket has not disclosed the identities of the security companies or law enforcement agencies involved in the investigation.

Similar measures have been used after other recent DeFi incidents, particularly when attackers attempt to move funds through bridges or centralized trading venues.

AFX suffered a cross-chain bridge exploit in July that drained 24.15 million USDC. Security firm Blockaid worked with the Arbitrum team to investigate the incident as the attacker transferred the stolen USDC to Ethereum and converted the proceeds into 12,467.5 ETH.

Earlier in June, Axelar disabled bridge routes connected to Secret Network after an exploit resulted in roughly $4.7 million in losses. Axelar said the incident was limited to bridged assets on Secret Network and did not compromise its core protocol.

Rocket has not disclosed whether any portion of the $287,000 has been frozen or recovered so far.

Smaller Rocket accounts are first in line for refunds

The team is preparing a recovery plan for users affected by the incident, with smaller accounts expected to receive priority when refunds begin.

Rocket said it understands that compensation is the update affected users are waiting for but will provide specific details only when it can do so responsibly. The platform has not yet disclosed the size of its available recovery funds, eligibility requirements, payment method or a timetable for reimbursements.

Recovery programs have taken different forms following previous attacks on decentralized trading protocols.

GMX, for example, completed a roughly $44 million compensation plan in August 2025 for liquidity providers affected by an exploit of its V1 GLP pool. The protocol used GLV tokens for distributions, while its DAO treasury covered a $2 million shortfall.

The GMX attacker had previously returned approximately $37.5 million of the roughly $42 million stolen after the protocol offered a 10% white-hat bounty. The affected V1 system was paused after the attack, while GMX V2 remained operational.

Rocket has not announced a similar bounty or offered terms directly to the attacker. Its current recovery effort remains focused on tracing the withdrawn funds and developing a reimbursement plan.

The platform warned users to watch for impersonators attempting to take advantage of the incident. Rocket said recovery information will be published only through its official X account and Discord channels, adding that team members will not contact affected users first through direct messages.

On Sept. 7, unidentified actors controlling nearly 4,000 BTC taken from Liquid Network offered to return “most” of the funds after Blockstream fixes the vulnerability behind the estimated $320 million incident.

The actors communicated their offer through Bitcoin transactions carrying OP_RETURN messages, according to a reconstruction published by Galaxy Research head Alex Thorn. They asked whether returning “most” of the Bitcoin to the federation’s address would be acceptable.

A later message told Blockstream to “fix the bug first” and ensure every node received the patch. The actors claimed the chain remained exposed under its latest software version and promised to transfer the money after confirming the repair.

That promise remains unverified. The actors did not define how much “most” represents, disclose their identities or provide a deadline. No confirmed return transaction had appeared when this article was prepared.

On-chain messages authenticate the negotiation

Blockstream initiated contact at Bitcoin block 965,822 by sending 1,000 satoshis with a message directing the recipient to its security team. Another transaction contained encrypted material and a detached signature verifiable against Blockstream’s published PGP key.

At block 965,869, the actors sent 1,000 satoshis to the federation’s peg address and asked about returning most of the funds. They provided their patch demand six blocks later. The messages establish that someone controlling the relevant Bitcoin could respond to Blockstream. They do not independently prove the actors’ motives.

The incident began with a peg-out of approximately 3,996 BTC. The corresponding Bitcoin transaction was confirmed in block 965,783 on Sept. 6. A separate transaction carried the initial claim: “we are whitehats. contact us on chain.”

The 4,000 BTC withdrawal exposed Liquid’s peg

Liquid confirmed that approximately 4,000 BTC had left its federation wallet. It described those responsible as “purported white-hat hackers,” preserving uncertainty around their status.

The network said the withdrawal used SideSwap’s Peg-out Authorization Key, or PAK. However, it said there was no evidence that the key itself was compromised. Liquid has not publicly explained the underlying vulnerability or released a technical postmortem.

Liquid operates as a Bitcoin sidechain whose users lock BTC and receive L-BTC for activity on the network. The federation holds the underlying Bitcoin and authorizes withdrawals back to the base layer. The transfer reportedly removed about 95% of the wallet’s Bitcoin.

Liquid disabled its bridge nodes and asked exchanges to suspend L-BTC deposits and withdrawals. It said other issued assets, including stablecoins and real-world assets, were not directly removed. The sidechain remained effectively paused while the investigation continued.

The episode adds another large loss to a year dominated by infrastructure failures. As crypto.news reported, crypto protocols lost at least $1.3 billion to hacks during the first eight months of 2026. In related coverage, an examination of cross-chain bridge security explained how concentrated custody and authorization systems can create large points of failure.

Blockstream must patch the network before any restart

Blockstream’s immediate task is to identify the flaw, prepare a patch and distribute it across the federation. The actors specifically demanded that every node be updated before repayment. Blockstream has not announced a patch version or reopening time.

A return can only be treated as confirmed after the Bitcoin moves to an address controlled by the federation. Even then, the amount retained by the actors and any proposed bounty would require disclosure.

Liquid must also account for the remaining reserves, explain how the peg-out bypassed normal controls and specify how L-BTC redemptions will resume. A technical postmortem would be needed to show whether the problem involved software, authorization logic, federation operations or another part of the withdrawal process.

Until those steps occur, the repayment remains a conditional promise and the “white hat” description remains disputed.

The key catalyst for the Australian dollar remains the July inflation data released on 26 August. The figure came in at 3.5% year-on-year, versus expectations of 3.2%, while the Trimmed Mean increased by 0.5% month-on-month, compared with a forecast of 0.3%. The following day, 27 August, NAB revised its forecast for the RBA’s next policy decision. The bank now expects a 25-basis-point rate hike at the September meeting, taking the rate to 4.6%, with the risk of another increase in November.

For the Canadian dollar, the key factor was the Bank of Canada’s decision. On 2 September, the central bank left its policy rate unchanged at 2.25% for the seventh consecutive meeting, highlighting economic uncertainty stemming from US tariffs and Canada’s retaliatory trade measures.

Technical Analysis of AUD/CAD

The four-hour AUD/CAD chart shows a pronounced uptrend that has lifted the pair towards the current resistance level at 0.9985. A pattern resembling a converging triangle formed near the top of this advance, with price fluctuations gradually narrowing within the formation. However, volume dynamics during the second half of the pattern’s formation have been atypical, casting doubt on its reliability.

Nevertheless, the price has broken out of the pattern while also moving above the upper boundary of the current market profile at 0.9950, and is attempting to establish itself above this level. If the advance continues, the red resistance level around 0.9985 is the next key obstacle on the upside.

In the event of a false breakout, the price could return to the profile. If the scenario turns bearish, the pair would need to break not only the upper boundary of the profile but also the Point of Control (POC) at 0.9935 and the lower boundary at 0.9910. Below the market density, a green support level is located around 0.9895.

The RSI + MAs indicator is showing readings of 59, 52 and 54. The RSI has moved above the neutral zone, while both the fast and slow moving averages remain below its upper boundary.

Key Takeaways

The atypical volume dynamics during the formation of the triangle leave the reliability of the breakout uncertain, while the price’s attempt to establish itself above the market profile has yet to receive confirmation from the RSI + MAs indicator. The pair’s further direction could depend largely on whether the expected tightening of RBA policy materialises against the backdrop of the Bank of Canada’s wait-and-see stance.

Trade over 50 forex markets 24 hours a day with FXOpen. Take advantage of low commissions, deep liquidity, and spreads from 0.0 pips (additional fees may apply). Open your FXOpen account now or learn more about trading forex with FXOpen.

This article represents the opinion of the Companies operating under the FXOpen brand only. It is not to be construed as an offer, solicitation, or recommendation with respect to products and services provided by the Companies operating under the FXOpen brand, nor is it to be considered financial advice.

Harmony is moving toward a full shutdown of its blockchain and a migration of its ONE token to Ethereum, according to a proposal shared by the network. The plan would culminate in a final network snapshot, followed by an airdrop of ERC-20 ONE tokens to the same addresses on Ethereum and steps to transition validator operations.

The announcement arrives after a recent Harmony exploit that involved the minting of unauthorized ONE tokens and raised the prospect of a rollback. With the latest proposal, Harmony’s approach appears to shift from repairing a compromised chain to ending the network as a standalone platform.

Key takeaways

• Harmony’s proposal targets a final block snapshot and issuance of ERC-20 ONE tokens on Ethereum, with holders receiving the new tokens to the same addresses.
• Harmony says the snapshot would include wallets, staking delegations, validator rewards, smart contracts, and centralized exchanges, with “no claims required.”
• The migration is not presented as binding, and the proposal does not specify when the final block would be produced or whether shutdown timing depends on a full on-chain governance vote.
• Users are told to exit smart contracts before Sept. 10 because “multisig safes, liquidity pools and onchain applications cannot be migrated.”
• Validators may choose to stop nodes, remain as governors, or join Harmony’s “AI-video initiative,” with a $1.372 million pool set aside for compensation for validators who exit on time and agree to serve as governors.

A planned end to Harmony’s mainnet—followed by an ERC-20 migration

In its Sunday proposal, Harmony outlined a transition designed to preserve token balances while discontinuing the underlying chain. The network stated it would take a final network snapshot and then issue ERC-20 ONE tokens on Ethereum, allocating the new tokens to the same addresses that held ONE at the time of the final block.

Harmony further described the snapshot scope as broad. It would record ONE balances across wallets, staking delegations, validator rewards, smart contracts, and centralized exchanges. The network also emphasized that holders would not need to take action to receive the new ERC-20 tokens—an important detail for retail participants and custodians alike.

Still, the proposal draws a clear boundary around what can and cannot be migrated. Harmony said multisig safes, liquidity pools, and onchain applications cannot be transferred, warning participants to unwind any smart-contract positions before Sept. 10. That requirement effectively shifts risk management onto users and protocol operators, particularly where liquidity or contract-based funds are involved.

Validator options, governance mechanics, and the open question of timing

Harmony’s transition plan is centered on validator decisions. The network said validators would receive options: stop their nodes, continue operating as governors, or participate in Harmony’s new AI-video initiative.

Harmony also referenced a governance framework consistent with its published network governance rules. According to Harmony’s governance documentation, elected validators can create proposals, while unelected validators may vote with voting power proportional to total stake. Under those rules, a proposal must reach participation threshold first: 51% of total stake weight must participate. Then it requires 66.7% support after a seven-day introduction period and a 14-day voting period.

However, Harmony described the Sunday proposal itself as “non-binding,” and it did not clarify whether the shutdown is guaranteed to follow the full validator-governance voting cycle or how precisely the final block timing would be determined. For investors and market participants, that uncertainty matters: the practical mechanics of when balances become fixed for snapshot purposes—and how orderly exchanges and custodians can coordinate—depend on the final execution plan.

Harmony also mentioned a compensation pool of $1.372 million for validators who shut down on time, keep their stakes, and agree to serve as governors. That figure indicates Harmony expects to retain some validator participation even after the main chain ceases producing blocks, but it does not specify how long governors would remain active in that role.

Recent exploit pressures: from rollback plans to a system-wide exit

The migration proposal comes less than four weeks after an exploit that created forged ONE tokens. Harmony said earlier it was considering a rollback after reports that an attacker had minted nearly 4 billion unauthorized ONE, an amount characterized at the time as roughly 26% of the token supply. Harmony later said it planned to revert the blockchain to an Aug. 11 checkpoint, discarding 109,126 regular transactions and 315 staking transactions.

According to Harmony’s earlier statements, investigators traced nearly all forged tokens to specific wallets or service boundaries and said they were working with exchanges, bridges, and law enforcement. While the rollback narrative focused on restoring the chain by undoing affected transactions, the new proposal effectively reframes the endgame: rather than continuing to operate Harmony’s blockchain and maintain state updates, Harmony is proposing a migration that relocates token ownership onto Ethereum.

For holders, this is a meaningful shift. A rollback aims to correct the ledger while preserving the chain’s continuity; a shutdown-and-migrate approach focuses on stabilizing token ownership by anchoring balances to an Ethereum-issued standard. The trade-off is that the ecosystem built atop Harmony—especially DeFi liquidity and onchain application state—may not survive in the same form because Harmony has said those components cannot be migrated.

What users should do before the September deadline

Harmony’s most urgent operational message is directed at smart-contract participants. By Sept. 10, Harmony urged users to exit all smart contracts, citing the inability to migrate multisig safes, liquidity pools, and onchain applications. That means users relying on staking-related smart-contract interactions, liquidity positions, or complex contract mechanisms may need to ensure they are fully withdrawn before migration-related execution begins.

While Harmony indicated that smart-contract-related ONE balances would be recorded at the final snapshot and ERC-20 tokens would be issued accordingly, the network’s warning suggests token balances alone may not capture the full value of positions that depend on liquidity pools or application-specific states. In other words, the migration can preserve ONE ownership, but it may not preserve the surrounding infrastructure in which ONE is locked or used.

Traders and long-term holders should also watch for how exchanges and custodians handle the ERC-20 distribution process. Harmony said the snapshot would include centralized exchange holdings, but the operational steps—such as whether exchanges require internal mapping from Harmony addresses to Ethereum accounts—are not detailed in the proposal text provided.

With Harmony moving toward an end-of-chain event and a token migration, market participants should track: whether validators ultimately ratify the shutdown through the governance thresholds described by Harmony’s framework, how Harmony confirms the snapshot and final block timing, and how DeFi and other onchain users unwind positions ahead of Sept. 10. The answers will determine how smoothly ONE holders can transition—and how much of the broader Harmony ecosystem can be meaningfully preserved.

What the results mean for the AfD

Hanwha Investment & Securities has reportedly completed a tokenized securities platform supporting Avalanche as South Korea prepares to bring blockchain-based securities into its regulated capital markets system in February 2027.

Seoul Economic Daily reported Sunday that the South Korean brokerage began developing the platform with blockchain technology firm FairSquare Lab in 2025. The system was built to operate across multiple networks, including Avalanche and enterprise Ethereum client Hyperledger Besu.

Development has come ahead of amendments to South Korea’s Electronic Securities Act and Capital Markets Act taking effect on Feb. 4, 2027. The changes will legally recognize distributed ledgers as securities registers and allow tokenized securities to operate within the country’s existing capital markets framework.

The Korea Securities Depository is preparing infrastructure capable of connecting with Avalanche, Hyperledger Besu and Hyperledger Fabric, giving securities companies several blockchain options as they build systems for the incoming framework.

Hanwha tokenized securities platform supports Avalanche

Hanwha started work on the platform last year and has since completed development, Seoul Economic Daily reported, citing blockchain industry sources.

FairSquare Lab developed the system with support for more than one distributed ledger. Alongside Avalanche, Hanwha can use Hyperledger Besu, an Ethereum-compatible blockchain designed for enterprise deployments.

Several South Korean financial firms have already used enterprise networks such as Hyperledger Besu for token securities infrastructure. Hanwha’s system extends that approach to Avalanche, where institutions can establish dedicated networks with controls over participation and validators.

The Korea Securities Depository is preparing its own token securities infrastructure to communicate with different blockchain technologies. Its published distributed-ledger requirements cover Avalanche, Hyperledger Besu and Hyperledger Fabric.

Participation in connected distributed ledgers will remain limited to approved institutions, including securities companies and the depository. The KSD would participate directly in the networks to oversee total issuance and electronic registration information.

Demand from financial companies influenced the inclusion of Avalanche, according to Seoul Economic Daily. A KSD official told the publication that several companies had requested support through industry consultations and existing projects.

Avalanche has already been used for regulated tokenized securities infrastructure in Japan. In July, Progmat moved its tokenized securities platform from Corda 5 to a dedicated Avalanche Layer 1, transferring every active security token project managed through its system.

Those projects represented more than 452 billion yen in underlying assets and issued securities at the time of the migration. Progmat said the change made the securities compatible with the Ethereum Virtual Machine while retaining existing institutional controls.

The Japanese platform redesigned its architecture so business functions were no longer tied to a single blockchain, using a separate layer between its applications and underlying ledger. Progmat said the structure would allow other networks to be connected later.

South Korea tokenized securities rules start in February

Hanwha’s platform arrives as South Korea finalizes the operating structure for tokenized securities before the February rollout.

The Financial Services Commission unveiled a three-stage implementation roadmap on Sept. 4, covering the types of securities that can initially be tokenized and how the market could expand after the amended laws take effect.

Crypto.news previously reported that South Korea’s tokenized securities roadmap will initially cover privately pooled money market funds and bonds reserved for institutional investors.

Unlisted shares issued through a trust structure and publicly offered fractional investment securities will qualify during the first stage as well.

The second phase would extend tokenization to all publicly offered securities. Regulators have not set a fixed date for that stage, with implementation depending on the results of the initial rollout and adoption of the required technology among market participants.

Under the final phase, the FSC plans to build onchain payment infrastructure linked to stablecoins, allowing the payment side of tokenized securities transactions to move onto blockchain rails.

Timing for the settlement system will depend partly on pending South Korean stablecoin legislation.

The roadmap follows amendments approved by the National Assembly in January that established a legal basis for distributed ledgers to serve as securities registers. Tokenized instruments will remain securities under existing financial laws instead of being treated as a separate asset class.

Regulators had been preparing the implementation details for months. In May, the FSC outlined its rulemaking schedule while studying how stocks, bonds and money market funds could be incorporated into the system.

The FSC said at the time that South Korea would not move its entire electronic securities market onto blockchain infrastructure at once. Authorities instead planned staged tests covering securities rights, trading, settlement and onchain payments.

Securities firms face infrastructure requirements

Financial companies connecting their distributed ledgers to the Korea Securities Depository will have to pass screening and operating tests under the KSD’s technical guidelines.

Reviews will cover issuance and circulation functions alongside contingency measures for system errors and other disruptions. The FSC has said securities firms must maintain operational stability comparable to the existing electronic securities system while using distributed ledgers.

Existing financial investment companies will not need a separate license solely for handling tokenized securities. Firms can conduct tokenized securities activities falling within their current licensed business areas.

Companies seeking to intermediate tokenized securities transactions on over-the-counter markets will need prior consultation with the Financial Supervisory Service.

Retail investors will face separate limits. The FSC has proposed capping individual subscriptions to non-monetary trust beneficiary certificates at the lower of 30 million won or 5% of the total issuance.

Annual net purchases by retail investors on each OTC exchange will be capped at 100 million won.

South Korea is preparing central market infrastructure at the same time. Samsung SDS has been developing a token securities platform for the Korea Securities Depository designed to connect blockchain records with the country’s existing electronic securities account infrastructure.

The platform is expected to support issuance, circulation checks, rights management and monitoring when the new system begins operating.

Hanwha expands its tokenization investments

Hanwha has spent several years building positions across companies involved in tokenization and blockchain infrastructure.

The conglomerate became Securitize’s largest shareholder after holdings spread across three affiliated entities reached a combined 9.6%, according to U.S. regulatory filings.

As reported in July, entities linked to Hanwha collectively held 15.69 million Securitize shares, putting the group ahead of Blockchain Capital and Securitize co-founder and CEO Carlos Domingo.

A private equity fund managed by Hanwha Asset Management accounted for a 5.9% stake. H Foundation, a Hanwha Systems subsidiary, held 3.1%, while Hanwha Investment & Securities controlled roughly 0.6%.

Hanwha Investment & Securities described its own purchase as a financial investment through a pre-IPO financing round. The brokerage left open the possibility of using the investment in its digital asset and real-world asset tokenization businesses.

Securitize provides tokenized asset infrastructure for financial institutions including BlackRock, Apollo, BNY, Hamilton Lane, KKR and VanEck. Its platform managed more than $4 billion in onchain assets and supported more than 650 tokenized funds earlier this year.

The company went public on the New York Stock Exchange under the ticker SECZ in July and issued blockchain-based versions of its common shares on Solana and Avalanche on the same day. The tokens represent the same NYSE-listed shares instead of a separate security class.

Hanwha Investment & Securities has put money into several other blockchain companies this year, including blockchain research and data company Xangle and Web3 infrastructure provider Kresus.

In July, the brokerage disclosed a 30 billion won, or roughly $22.3 million, investment in Digital Asset, the operator of the institutional-focused Canton Network.

Hanwha Investment & Securities has increased its position in South Korea’s crypto sector as well, investing another 597.8 billion won in Dunamu, the operator of Upbit, and raising its ownership stake to 9.84%.