Harmony ONE Exploit: 4 Billion Tokens Minted, Rollback Weighed

Short answer: On August 12, 2026, Harmony confirmed that an attacker had minted unbacked ONE tokens through a flaw in cross-shard validation, about 4 billion by on-chain estimates, or roughly 26% of circulating supply. The team shipped an emergency patch, paused its bridge, asked exchanges to freeze the funds and said rolling the chain back to before the attack looks like the most practical fix.

What happened

Harmony is a proof-of-stake layer-1 blockchain launched in 2019. It splits its network into shards, parallel chains that exchange tokens through cross-shard "receipts". Late on August 11 UTC, an attacker began submitting forged receipts that the network accepted as valid. Each one credited new ONE tokens without debiting any sender.

On-chain analyst Juiceberg first spotted about 4 billion ONE created through empty blocks. That was roughly 26% of the approximately 15 billion ONE in circulation. About 2.8 billion ONE reached exchange deposit addresses before trading could be stopped, and ONE fell by more than a third within hours, to a record low. Harmony confirmed unauthorized minting but did not independently confirm the analyst's total, and investigators are still tracing whether more forged receipts exist.

How the Harmony exploit worked

According to Harmony's patch notes, the attacker combined two bugs in how receipts were checked:

1. Broken quorum check. The code counted the validator keys listed in a signature mask instead of the validators that actually signed. A receipt with an empty signer record could therefore look as if the whole committee had approved it.
2. Replay gap. Proof fields were not tied to a specific block header, so a receipt that had already been processed could be presented again as new and credited twice.

Neither bug required stealing private keys. This was a logic flaw in consensus code, the kind of error that is hard to spot in audits and very expensive when it is exploited. It is also a different kind of attack from Harmony's best-known incident, the June 2022 Horizon bridge hack. In that case about $100 million was taken after bridge multisig keys were compromised, and the FBI later attributed the attack to North Korea's Lazarus Group.

Why a Harmony rollback is controversial

A rollback means validators agree to discard every block after a chosen point and restart from there. It erases the forged tokens, but it also erases every legitimate transaction made since that point, and the longer the decision takes, the more honest activity is lost.

• For: the forged ONE was created from nothing. Leaving it in circulation would permanently dilute every honest holder.
• Against: immutability is the main promise of a blockchain. A small validator set that can rewind history shows how centralized the network is in practice.
• The exchange problem: some forged ONE was already sold for other assets on exchanges. A rollback on Harmony cannot undo those trades, so exchanges may have to absorb those losses on their own books.

The attacker's direct gain was modest in dollar terms. The Block valued the first 4 billion forged tokens at about $3.2 million, because ONE had lost most of its value long before this incident. The larger damage is to trust in the network and its validators.

What it means for you

• Do not send ONE to or from the Harmony chain until Harmony announces a final fix and exchanges reopen deposits. If a rollback goes ahead, recent transactions can be reversed.
• Check your exchange's notices. Most major venues suspend deposits and withdrawals for a token during an incident and a rollback.
• Be careful with "cheap" ONE offers. After a forged mint, unbacked tokens may still circulate on smaller venues or bridges that missed the freeze.
• Think about concentration. Small layer-1 tokens with thin liquidity and small validator sets carry protocol risk on top of price risk. Our crypto wallet security guide covers how to spread that risk.

Cross-chain infrastructure keeps showing up in incidents like this, whether through bridges or internal cross-shard messages. We explain the mechanics in how cross-chain bridges work.

Key takeaways

• An attacker forged ONE tokens on Harmony through two bugs in cross-shard receipt validation, starting late on August 11, 2026.
• About 4 billion ONE was minted, roughly 26% of circulating supply, and about 2.8 billion reached exchanges.
• Harmony patched the flaws on August 12 with release v2026.1.1, and 53% of validators upgraded within four hours.
• Exchanges were asked to freeze funds from four attacker wallet pairs, the bridge is paused, and a rollback is the favored option.

Before swapping any token affected by an incident, check whether it is currently available on the supported coins page. Deposits for affected networks are normally suspended until the chain is stable.

Sources: The Block, CryptoSlate, Coin360, CoinDesk