Holograph 2024 unauthorized HLG mint
A malicious actor exploited the Holograph Operator contract and minted one billion additional HLG tokens on Mantle. The team patched the initial exploit, temporarily locked the protocol, coordinated account freezes, and announced a staged burn plan and external investigation.
Incident facts
- Incident title
- Holograph 2024 unauthorized HLG mint
- Bridge
- Holograph Protocol
- Incident date
- 2024-06-13
- Incident type
- Unauthorized Token Mint
- Major incident
- Yes
- Affected chains
- Mantle, Ethereum, Unknown
- Affected assets
- HLG
- Attack category
- Privileged Operator Contract Access
- Reported loss
- 1 billion HLG unauthorized mint; realized loss not fixed
- Amount confidence
- High
- Loss amount basis
- Official Incident Statement Quoted By Contemporaneous Reporting
- Recovery
- Partial Freeze And Burn Plan
- Reimbursement
- Not Announced
- Restart
- Protocol Locked Then Partial Reopen
- Current outcome
- Historical Protocol Inactive
- Postmortem
- Partial
- Resolution
- Unresolved
- Last reviewed
- 2026-06-16
- Last verified
- 2026-06-16
Amount and valuation
The incident created one billion unauthorized HLG. Contemporary fiat valuations varied with the rapidly falling token price and do not establish a single realized protocol or user loss.
Unauthorized supply, tokens sold, tokens frozen, and tokens burned are separate quantities.
1 billion unauthorized HLG mintedapproximately $14.4 million at the pre-collapse quoted price in some reporting
The fiat figure is not used as canonical realized loss.
Why this remains unresolved
- Completion of the announced one-billion-HLG burn plan was not established.
- The final quantity sold, frozen, recovered, or permanently removed remains unresolved in the reviewed evidence.
Timeline events
Holograph Operator contract exploited2024-06-13
A malicious actor used the Holograph Operator contract to mint one billion additional HLG. Holograph said it patched the initial exploit and began coordinating with exchanges and law enforcement.
Protocol locked and part of unauthorized supply frozen2024-06-15
Incident updates reported that the protocol was temporarily locked and that at least part of the unauthorized HLG supply was frozen through exchange coordination.
The exact frozen quantity and custody status require later verification.
Holograph announced staged HLG burn plan2024-06-19
Holograph announced a plan to remove one billion HLG through frozen exchange balances, treasury tokens, and open-market purchases; the first tranche burned approximately 53 million HLG.
Investigation attributed incident to former contractor2024-07-02
Reporting on Holograph's investigation with Halborn said a former contractor had retained or created privileged access used to mint the unauthorized supply.
The reviewed source is secondary reporting on the investigation.
Evidence records
- Holograph statement on the Holograph Operator exploitHolograph · Tier 1 · High reliability · primary · 2024-06-13Claim scope: Incident Case
Official incident statement quoted by contemporaneous reporting; Direct x.com route and indexed references were rechecked on 2026-07-29; the canonical post URL remains available.
- HLG Down Over 60% as Exploiter Mints 1 Billion New TokensCoinDesk · Tier 2 · High reliability · secondary · 2024-06-13Claim scope: Incident Case
Contemporaneous report quoting Holograph's official statement.
- Holograph Announces HLG Burn Plan and Halborn PartnershipHolograph via Chainwire · Tier 1 · High reliability · primary · 2024-06-19Claim scope: Recovery
Issuer-supplied press release describing the burn plan, first burn tranche, and security engagement.
- Holograph protocol sabotaged by disgruntled contractorCointelegraph · Tier 2 · Medium reliability · secondary · 2024-07-03Claim scope: Incident Followup
Secondary reporting on Holograph's investigation and former-contractor attribution.
- Holograph statement on the Holograph Operator exploitHolograph · Tier 1 · High reliability · primary · 2024-06-13Claim scope: Recovery
Event-scoped duplicate supporting the protocol lock and coordinated freezing response. Direct x.com route and indexed references were rechecked on 2026-07-29; the canonical post URL remains available.
- HLG Down Over 60% as Exploiter Mints 1 Billion New TokensCoinDesk · Tier 2 · High reliability · secondary · 2024-06-13Claim scope: Recovery
Event-scoped duplicate independently supporting the freeze and containment context.
- Holograph incident postmortem announcementHolograph · Tier 1 · High reliability · primary · 2024-07-02Claim scope: Root Cause
First-party announcement of the completed postmortem with Halborn, including the former-contractor access path and the protocol response.
Source tiers describe evidence authority, not certainty for every claim. Tier 1 is the strongest source class; Tier 2 and Tier 3 provide progressively more secondary or supporting context. Source notes define what each record actually supports.
Known unknowns
- The final Halborn report URL was not located in stable official documentation.
- The relationship between the historical omnichain protocol and the current same-domain trading terminal is not established as a canonical successor.
Help maintain incident aftermath records
Support recovery, reimbursement, restart, migration, shutdown, evidence, and correction checks.
Report a correction
Report missing evidence, incorrect dates, outcome changes, recovery details, reimbursement status, or broken links. GitHub Issues are preferred for structured review; the Google Form is available if you do not use GitHub.