EvoVerses, Cosmic Universe Ditch Harmony; DFK on the Fence

At least two upcoming GameFi projects announced plans over the weekend to leave the Harmony Network, deriding its “reckless” approach to security after Thursday’s revelation that it had lost$100 million to a hacker who breached its Horizon bridge.

“There are many reasons for migrating, most of which the Harmony community is well aware of at this point (and some they are not), but by far the biggest and most important reason of all is because over 1/3 of the total TVL of Harmony has been stolen,” Cosmic Universe’s pseudonymous founder, Wizzard Blizzard, wrote in a Sunday Medium post announcing that his project was migrating to Avalanche (AVAX).

“Harmony only had two signatures needed out of four in order for the hack to be possible,” he added. “This is not even on par with what Harmony requires all grant recipients to have set up, showing a severe and reckless security mindset that is simply too dangerous, in our eyes, to consider our project to be safe on Harmony anymore, especially considering this is not the first security issue or issue in general and how big we expect our project to become.”

EvoVerses developer Domwaut announced in that group’s Discord chatroom on Friday that EvoVerses would make the same move writing, “Avalanche is our destination chain, even if it is temporary. This choice was made on [value of locked holdings], stability, accessibility, and potential for partnerships.”

He added that if the chain turned proved “less than ideal,” developers would search for an alternative.

Neither project has announced whether they will seek to retain a presence on Harmony. Cosmic Universe’s market capitalization stood around $3.4 million as of Sunday, while EvoVerses stood at $2.7 million, for a combined total a little higher than $6 million.

DeFi Kingdoms’ (DFK) Bolon Soron, meanwhile, said that game was preparing for a “worst case scenario” by taking a snapshot of assets — primarily NFTs, including the game’s playable characters, known as “heroes” — in order to facilitate a migration to AVAX in the event Harmony became inoperable.

“We do want to assure everyone that none of our smart contracts have been hacked,” Soron wrote in a Friday message in the group’s Discord. “In addition, we are preparing for a worst case scenario. We have set up a node to take snapshots of all DFK Assets, including Jewel … Heroes Pets, and Inventory. In the event that Harmony were to stop operating, which we hope will not be the case of course, we would be able to replicate these assets once [we] launched with a new home.”

The project is the largest on Harmony, with a little more than $15 million in value in its native cryptocurrencies — Jewel and Crystal — and a hard-to-estimate amount held in its playable NFTs. Developers established a second version of the game on AVAX in March without the intention of completely departing from Harmony’s chain.

Harmony founder and CEO Stephen Tse on Saturday confirmed suspicions that the hacker behind the $100 million heist used a social-engineering attack, tricking developers into handing over two of the keys needed to remove funds from the project’s Horizon bridge. The incident transpired more than two months after a developer on Twitter — going by the screen name of “Ape Dev” —warned that it was likely to happen if developers failed to act, noting it was the same approach taken by hackers who stole $600 million from Axie Infinity’s Ronin bridge in March.

“All in all, if two of the four multisig signers are compromised, we’re going to see another 9 figure hack,” Ape Dev wrote in the April warning. “Considering all that’s been going on lately, it’d be interesting to hear some details from @harmonyprotocol on how these … are secured.”