{"investigation":{"slug":"harbor-protocol","entity_name":"Harbor Protocol","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Harbor Protocol is a decentralized collateralized-debt-position (CDP) protocol built on the Comdex chain (Cosmos SDK / CosmWasm) that enabled users to mint the Composite stablecoin (CMST) against whitelisted collateral assets. The protocol suffered two distinct security incidents in 2023 — an oracle-manipulation liquidation event in June and a direct vault drain exploit in August — after which its total value locked collapsed to effectively zero. As of 2025 the protocol appears inactive, with the HARBOR governance token near worthless and no meaningful community or development activity detected.","sections":[{"content":"Harbor Protocol is a decentralized application built on the Comdex blockchain, a Cosmos SDK and CosmWasm-powered chain purpose-built for DeFi infrastructure. Harbor's core function is to allow users to deposit safelisted collateral assets — including ATOM, stOSMO, axlUSDC, LUNA, and WMATIC — into vaults and mint Composite (CMST), an over-collateralized, dollar-pegged stablecoin designed for the Inter-Blockchain Communication (IBC) ecosystem. The protocol's design was explicitly inspired by MakerDAO's DAI model, with HARBOR token playing the role of MKR as both a governance and recapitalization token. Harbor launched on mainnet on November 24, 2022. Revenue was generated through stability fees, drawdown fees, and liquidation fees, with a portion used to buy back and burn HARBOR via surplus auctions. A vote-escrowed version of the token (veHARBOR) governed key risk parameters such as collateralization ratios and fee structures.","heading":"Protocol Overview","sources":[{"url":"https://anieljoshua94.medium.com/understanding-the-harbor-protocol-ecosystem-and-tokenomics-harbor-and-veharbor-af658df1216f","name":"anieljoshua94.medium.com","type":"other","credibility":3},{"url":"https://www.coinlive.com/news-flash/7793","name":"coinlive.com","type":"other","credibility":3},{"url":"https://harborprotocol.one/","name":"harborprotocol.one","type":"other","credibility":3},{"url":"https://docs.harborprotocol.one/harbor-protocol","name":"docs.harborprotocol.one","type":"other","credibility":3}],"severity":"medium"},{"content":"On or around June 29, 2023, Harbor Protocol experienced its first documented security incident: an oracle failure that resulted in the erroneous liquidation of stATOM collateral vaults. The root cause was a sudden spike in trading volume on ShadeSwap following the protocol's listing on CoinGecko. CoinGecko uses a volume-weighted average price mechanism, and the inflated volume caused stATOM's price to be recorded at approximately $0.02 per token, far below its true market value of approximately $10. This inaccurate price feed triggered automated liquidations of stATOM vaults at $6.67, with auctions starting at roughly $7.67 — a significant discount to the real market rate. Harbor Protocol published an incident report on the Comdex blog documenting the root cause and acknowledging the impact on stATOM vault holders. The team cited limited market depth for liquid-staked assets within the Cosmos ecosystem as a contributing structural factor. This incident predated the more severe August exploit and foreshadowed the protocol's vulnerability to price oracle manipulation.","heading":"June 2023 Oracle Incident","sources":[{"url":"https://blog.comdex.one/harbor-protocol-oracle-incident-report-654ff67b25b","name":"blog.comdex.one","type":"other","credibility":3},{"url":"https://therecord.media/millions-stolen-exactly-harbor-protocol-defi-cryptocurrency","name":"therecord.media","type":"other","credibility":3}],"severity":"medium"},{"content":"On August 18–19, 2023, Harbor Protocol suffered a second and more serious exploit in which an attacker drained funds from multiple vaults including the stable-mint vault and the stOSMO, LUNA, and WMATIC collateral pools. The attacker's on-chain address was identified as comdex1sma0ntw7fq3fpux8suxkm9h8y642fuqt0ujwt5. According to subsequent analysis, the attack involved manipulation of collateral asset prices — specifically LUNA, stOSMO, and WMATIC — via Harbor's pricing source on cSwap, Comdex's native DEX. By inflating the reported prices of these collateral assets, the attacker was able to borrow CMST at artificially elevated collateral valuations. The minted CMST was then bridged to the Crescent network and swapped into axlUSDC (Axelar-bridged USDC) in small batches to obscure the trail. Total losses were estimated at approximately $250,000–$289,000 based on the TVL drop from roughly $370,000 to approximately $81,000 as recorded by DefiLlama. However, the protocol team did not disclose an exact figure at the time of the announcement, stating they were still calculating losses. Harbor Protocol issued a public appeal to the attacker to make contact, saying the team was 'open to talk to find a solution that is optimal and doesn't impact users and community members.' No public recovery of funds has been reported. The incident occurred the same week as a separate exploit on the Exactly Protocol (BNB Chain), with which it was confirmed to be unrelated by blockchain security firms DeDotFi and PeckShield.","heading":"August 2023 Vault Drain Exploit","sources":[{"url":"https://www.web3isgoinggreat.com/?id=harbor-protocol-exploit","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://therecord.media/millions-stolen-exactly-harbor-protocol-defi-cryptocurrency","name":"therecord.media","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/harbor-protocol-reports-exploit-as-funds-stolen-from-vaults/","name":"cryptotimes.io","type":"other","credibility":3},{"url":"https://crypto.news/harbor-protocol-falls-victim-attack-funds-missing/","name":"crypto.news","type":"other","credibility":3},{"url":"https://www.bitdegree.org/crypto/news/over-7m-stolen-in-separate-attacks-against-defi-protocols-exactly-and-harbor","name":"bitdegree.org","type":"other","credibility":3},{"url":"https://defillama.com/protocol/harbor-protocol","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Harbor Protocol's crisis communication during the August 2023 exploit drew significant community criticism. Community members publicly stated that 'still no statement from the team. We don't even know how much money was stolen,' reflecting frustration at the pace of disclosure. The team's initial post-exploit statement confirmed the incident but acknowledged they had not yet identified the attack pattern, and committed to publishing a detailed incident report once their investigation was complete. The team pledged to work toward 'making affected users whole' but did not commit to a specific compensation timeline or mechanism. A detailed post-mortem was published on the Comdex blog by Harbor Protocol, describing the oracle/price manipulation vector involving cSwap. Leadership of the protocol is associated with Comdex co-founder and COO Siddarth Patil, who has been publicly identified as leading Harbor Protocol's airdrop and ecosystem initiatives. No regulatory filings, law enforcement referrals, or formal user compensation programs have been identified in open-source records following the August 2023 exploit.","heading":"Team Response and Communication Failures","sources":[{"url":"https://therecord.media/millions-stolen-exactly-harbor-protocol-defi-cryptocurrency","name":"therecord.media","type":"other","credibility":3},{"url":"https://blog.comdex.one/harbor-protocol-exploit-breakdown-incident-report-b07cd117b1d6","name":"blog.comdex.one","type":"other","credibility":3},{"url":"https://blocktelegraph.io/harbor-protocol-airdrop-siddarth-patil-of-comdex/","name":"blocktelegraph.io","type":"other","credibility":3},{"url":"https://cryptoslate.com/people/siddarth-patil/","name":"cryptoslate.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The HARBOR governance token has experienced near-total value erosion since the protocol's 2022 launch. Coinbase price data shows the token trading at approximately $0.000190 as of available records. CoinGecko data for the token reflects an all-time high reached on or around January 11, 2024, from which the token subsequently collapsed. DefiLlama reports Harbor Protocol's current TVL as $0, consistent with protocol inactivity following the August 2023 exploit. The protocol was never listed on a major centralized exchange. The HARBOR token had no exchange listing at the time of the exploit, and secondary market liquidity was extremely thin. CoinCarp noted the token had not been listed on any recognized CEX or DEX at the time of its reporting. These liquidity conditions amplified the oracle manipulation vulnerability that led to the June 2023 incident. As of 2025, there is no detectable active development, governance activity, or community updates from Harbor Protocol's official channels. The Medium blog and Twitter/X account have not published material updates post-exploit based on available search results.","heading":"Token Performance and Protocol Decline","sources":[{"url":"https://defillama.com/protocol/harbor-protocol","name":"defillama.com","type":"other","credibility":3},{"url":"https://www.coinbase.com/price/harbor-protocol","name":"coinbase.com","type":"other","credibility":3},{"url":"https://www.coingecko.com/en/coins/harbor-protocol","name":"coingecko.com","type":"other","credibility":3},{"url":"https://www.coincarp.com/currencies/harbor-protocol/","name":"coincarp.com","type":"other","credibility":3},{"url":"https://holder.io/coins/harbor/","name":"holder.io","type":"other","credibility":3}],"severity":"medium"},{"content":"Harbor Protocol presents several compounding risk factors for users and counterparties. First, the protocol experienced two security incidents within a three-month window in 2023, suggesting systemic vulnerability in its oracle design and price feed architecture. Second, the August 2023 exploit involved a price manipulation attack via Comdex's native DEX (cSwap), indicating the protocol lacked circuit-breakers or oracle safeguards sufficient to detect anomalous price deviations in thin markets. Third, post-exploit TVL collapsed to zero and has not recovered, indicating the protocol has effectively ceased operations without a formal shutdown announcement or structured wind-down. Fourth, the HARBOR governance token has depreciated to near-zero, eliminating any recapitalization mechanism that theoretically backed CMST's peg. Fifth, affected users have no confirmed path to compensation based on available public records. ZachXBT, the pseudonymous on-chain investigator known for tracing stolen crypto funds, has flagged Harbor Protocol as a point of concern within the context of DeFi exploit tracking. No independent security audit from a major firm (Halborn, Certik, Trail of Bits) has been identified in open-source search results for Harbor Protocol's smart contracts. The combination of thin liquidity, oracle reliance on a low-depth DEX, two exploits, zero TVL, and no recovery program results in an elevated risk classification.","heading":"Risk Profile and Trust Assessment","sources":[{"url":"https://www.web3isgoinggreat.com/?id=harbor-protocol-exploit","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://therecord.media/millions-stolen-exactly-harbor-protocol-defi-cryptocurrency","name":"therecord.media","type":"other","credibility":3},{"url":"https://defillama.com/protocol/harbor-protocol","name":"defillama.com","type":"other","credibility":3},{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","credibility":3},{"url":"https://blog.comdex.one/harbor-protocol-oracle-incident-report-654ff67b25b","name":"blog.comdex.one","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2022-11-24","event":"Harbor Protocol officially launches on the Comdex mainnet, enabling CMST minting against safelisted collateral assets.","source":""},{"date":"2023-06-29","event":"Oracle incident: stATOM vault liquidations triggered by a faulty CoinGecko volume-weighted price feed that recorded stATOM at ~$0.02 instead of ~$10, causing vaults to be liquidated at deep discounts to market value.","source":""},{"date":"2023-08-18","event":"Vault drain exploit begins: attacker (comdex1sma0ntw7fq3fpux8suxkm9h8y642fuqt0ujwt5) manipulates cSwap prices for LUNA, stOSMO, and WMATIC collateral to borrow CMST far above real collateral values.","source":""},{"date":"2023-08-19","event":"Harbor Protocol publicly discloses the exploit, confirming funds were drained from stable-mint and multiple collateral vaults. TVL drops from approximately $370,000 to $81,000. Team appeals to attacker to make contact.","source":""},{"date":"2023-08-19","event":"Blockchain security firms DeDotFi and PeckShield confirm the Harbor exploit is unrelated to a concurrent Exactly Protocol attack on BNB Chain.","source":""},{"date":"2024-01-11","event":"HARBOR token records its all-time high price on CoinGecko before subsequently collapsing in value.","source":""},{"date":"2025","event":"DefiLlama records Harbor Protocol TVL at $0. No active governance, development, or community updates detected as of 2025. Protocol appears effectively inactive.","source":"","date_original":"2025-01-01"}],"sources_used":[{"url":"https://anieljoshua94.medium.com/understanding-the-harbor-protocol-ecosystem-and-tokenomics-harbor-and-veharbor-af658df1216f","name":"anieljoshua94.medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coinlive.com/news-flash/7793","name":"coinlive.com","type":"other","archive_url":"https://web.archive.org/web/20260829150243/https://www.coinlive.com/news-flash/7793","credibility":3,"archive_timestamp":"2026-08-29T15:02:43+00:00"},{"url":"https://harborprotocol.one/","name":"harborprotocol.one","type":"other","archive_url":"http://web.archive.org/web/20251115111403/https://harborprotocol.one/","credibility":3,"archive_timestamp":"2025-11-15T11:14:03+00:00"},{"url":"https://docs.harborprotocol.one/harbor-protocol","name":"docs.harborprotocol.one","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://blog.comdex.one/harbor-protocol-oracle-incident-report-654ff67b25b","name":"blog.comdex.one","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://therecord.media/millions-stolen-exactly-harbor-protocol-defi-cryptocurrency","name":"therecord.media","type":"other","archive_url":"http://web.archive.org/web/20260413105723/https://therecord.media/millions-stolen-exactly-harbor-protocol-defi-cryptocurrency","credibility":3,"archive_timestamp":"2026-04-13T10:57:23+00:00"},{"url":"https://www.web3isgoinggreat.com/?id=harbor-protocol-exploit","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20260412233242/https://www.web3isgoinggreat.com/?id=harbor-protocol-exploit","credibility":3,"archive_timestamp":"2026-04-12T23:32:42+00:00"},{"url":"https://www.cryptotimes.io/harbor-protocol-reports-exploit-as-funds-stolen-from-vaults/","name":"cryptotimes.io","type":"other","archive_url":"https://web.archive.org/web/20260829190003/https://www.cryptotimes.io/harbor-protocol-reports-exploit-as-funds-stolen-from-vaults/","credibility":3,"archive_timestamp":"2026-08-29T19:00:03+00:00"},{"url":"https://crypto.news/harbor-protocol-falls-victim-attack-funds-missing/","name":"crypto.news","type":"other","archive_url":"https://web.archive.org/web/20260829131406/https://crypto.news/harbor-protocol-falls-victim-attack-funds-missing/","credibility":3,"archive_timestamp":"2026-08-29T13:14:06+00:00"},{"url":"https://www.bitdegree.org/crypto/news/over-7m-stolen-in-separate-attacks-against-defi-protocols-exactly-and-harbor","name":"bitdegree.org","type":"other","archive_url":"https://web.archive.org/web/20260830044838/https://www.bitdegree.org/crypto/news/over-7m-stolen-in-separate-attacks-against-defi-protocols-exactly-and-harbor","credibility":3,"archive_timestamp":"2026-08-30T04:48:38+00:00"},{"url":"https://defillama.com/protocol/harbor-protocol","name":"defillama.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://blog.comdex.one/harbor-protocol-exploit-breakdown-incident-report-b07cd117b1d6","name":"blog.comdex.one","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://blocktelegraph.io/harbor-protocol-airdrop-siddarth-patil-of-comdex/","name":"blocktelegraph.io","type":"other","archive_url":"https://web.archive.org/web/20260830040159/https://blocktelegraph.io/harbor-protocol-airdrop-siddarth-patil-of-comdex/","credibility":3,"archive_timestamp":"2026-08-30T04:01:59+00:00"},{"url":"https://cryptoslate.com/people/siddarth-patil/","name":"cryptoslate.com","type":"other","archive_url":"http://web.archive.org/web/20260807091456/https://cryptoslate.com/people/siddarth-patil/","credibility":3,"archive_timestamp":"2026-08-07T09:14:56+00:00"},{"url":"https://www.coinbase.com/price/harbor-protocol","name":"coinbase.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coingecko.com/en/coins/harbor-protocol","name":"coingecko.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coincarp.com/currencies/harbor-protocol/","name":"coincarp.com","type":"other","archive_url":"https://web.archive.org/web/20260830045647/https://www.coincarp.com/currencies/harbor-protocol/","credibility":3,"archive_timestamp":"2026-08-30T04:56:47+00:00"},{"url":"https://holder.io/coins/harbor/","name":"holder.io","type":"other","archive_url":"https://web.archive.org/web/20260829134342/https://holder.io/coins/harbor/","credibility":3,"archive_timestamp":"2026-08-29T13:43:42+00:00"},{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","archive_url":"http://web.archive.org/web/20260711020137/https://en.wikipedia.org/wiki/ZachXBT","credibility":3,"archive_timestamp":"2026-07-11T02:01:37+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:38.736425+00:00","updated_at":"2026-08-30T05:14:10.025027+00:00"}}