Explained: the Harmony ONE hack (August 2026). 08.24.2026 In August 2026, Harmony, the Layer-1 that supports the ONE token, was the victim of an unauthorized minting attack. The attacker created an estimated 4 billion ONE tokens worth an estimated $3.2 million in an empty-block minting exploit. Inside the attack. The Harmony One attacker took advantage of a vulnerability in how Harmony handled consensus. This vulnerability allowed them to perform an unauthorized mint that increased the circulating supply of the token by about 26%. The root cause of the hack was an issue in how the consensus code verified a quorum for a transaction. Instead of checking the number of validators that signed off on a transaction, the protocol counted the number of public keys that were listed within a signature mask. Since public keys are inherently public, anyone can build a list of public keys for eligible validators on the Harmony blockchain. By only checking the length of the provided list rather than the number of validators that actually signed the transaction, the protocol was essentially checking the length of a list of attacker-provided, publicly accessible data. The Harmony hacker took advantage of this fact to submit a series of empty blocks that created new tokens without actually passing through consensus. Additionally, the protocol's totalSupply endpoint, which is the official source for the total circulating supply of tokens, didn't immediately update its number to include the newly minted tokens. The minted tokens were distributed across 409 wallets in 10,288 transactions. Due to the delay in updating the totalSupply, the attacker was able to move many of the tokens to exchanges and cash out before the hack was detected. This incident had a significant impact on the supply and value of the ONE token. The unauthorized tokens increased the total supply by over a quarter and caused the token price to drop by about 40%. The blockchain is planning a rollback to eliminate the excess token supply. Lessons learned from the attack. The Harmony ONE hacker exploited a fundamental bug in how the blockchain handled block approvals. Since most blocks would only submit a list of validators that actually signed the block, the vulnerability flew under the radar until exploited by the attacker. This incident demonstrates the importance of comprehensive code reviews before code deployment. Halborn's Code Security Audit services validate both code security and business logic to help avoid costly errors. To learn more about securing your project, get in touch with Halborn. Disclaimer. The information in this blog is for general educational and informational purposes only and does not constitute legal, financial, or professional advice. Halborn makes no representations as to the accuracy or completeness of the content, which may be updated or changed without notice. THIS WEBSITE USES COOKIES We use cookies to personalise content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our social media, advertising and analytics partners who may combine it with other information that you've provided to them or that they've collected from your use of their services. You consent to our cookies if you continue to use our website. Learn More.

Harmony Protocol to roll back network after massive exploit. [adinserter block="2"] Key takeaways. Harmony Protocol suffers exploit resulting in 2.385 trillion unauthorized ONE tokens minted on Aug. 12.ONE token price tumbled over 30% following the massive surge in unauthorized token supply.Developers, security teams, and law enforcement align to execute a blockchain rollback to Aug. 11. Token inflation. Developers behind the Harmony blockchain protocol announced Aug. 17 that they will execute a full network rollback to Aug. 11 following a security exploit that enabled an attacker to mint trillions of ONE tokens. According to a technical update released by the team, Harmony will roll back Shard 0 to block height 92,730,034 and Shard 1 to block height 94,978,278, effectively reverting the state of the blockchain to 23:25:37 UTC on Aug. 11, before the initial breach. The incident began on Aug. 12 when an attacker exploited vulnerabilities in cross-shard receipt validation and quorum verification code to forge tokens. While early estimates identified an initial illicit minting of 4 billion ONE tokens, subsequent on-chain analysis revealed that a single wallet attempted 534 fraudulent transfers of 5 billion ONE each within a 106-second window. A total of 477 of those transactions succeeded, resulting in the unauthorized creation and transfer of 2.385 trillion ONE tokens. The massive, unexpected surge in token supply triggered an immediate crash in the price of ONE, which dropped by more than 30% as billions of forged tokens were quickly routed to cryptocurrency exchanges. Harmony developers deployed an emergency patch, Mainnet v2026.1.1, to prevent further unauthorized token creation, suspended cross-chain bridge services, and requested that cryptocurrency exchanges freeze wallet addresses linked to the exploit. In Monday's announcement, the project team stated it had evaluated alternative remedies - including targeted token burns, blacklisting specific address clusters, selective transaction replaying, and token migration - before concluding that a fixed-window rollback was the only solution that would not risk damaging unrelated funds or causing permanent chain state inconsistencies. The team confirmed that over 99.9% of the forged token flows have been traced with the assistance of an independent security firm, and that law enforcement, bridge providers, and partner exchanges are coordinating on the recovery effort. Under the rollback plan, network validators will adopt replacement databases starting at the target checkpoint blocks and begin regenerating new blocks from that point forward. Harmony, which was also hacked in 2022, noted that 141,628 consecutive blocks on Shard 0 generated between the rollback point and the network pause, containing 109,126 regular user transactions and 315 staking transactions, will be permanently discarded. [adinserter block="2"]

Harmony blockchain exploit mints 4 billion ONE tokens. Emergency patch and potential rollback follow major security breach. Reading Time: 4 mins read Harmony blockchain has suffered a major security exploit that resulted in the fraudulent minting of approximately 4 billion ONE tokens, representing about 26% of the cryptocurrency's total supply. The incident involved a vulnerability associated with empty blocks and triggered a rapid movement of the newly created tokens across hundreds of wallets. The scale of the exploit has raised concerns about the impact on existing ONE holders, market stability and the blockchain's transaction history. More than 10,000 transfers involving the fraudulently minted tokens were traced across 409 wallets. Of the affected tokens, about 2.8 billion were reportedly transferred to cryptocurrency exchanges, contributing to a sharp decline in the price of ONE, which fell by as much as 50%. Harmony has responded by deploying an emergency software patch, asking validators to upgrade, pausing its bridge and working with exchanges to freeze funds linked to the exploit. Harmony traces funds and alerts exchanges. Harmony said its investigation had identified 10,288 transfers involving the affected tokens across the 409 wallets where the assets had been distributed. The blockchain project also notified exchange partners about hundreds of suspicious deposit transactions associated with the stolen funds. According to Harmony, exchange partners responded by blocking and freezing the identified hacker-controlled wallets. The company also provided exchanges with information linking the suspicious funds to four wallet addresses believed to be connected to the exploit. The effort is intended to prevent the fraudulently created ONE tokens from being converted into other assets or withdrawn from trading platforms while the blockchain team determines how to address the underlying damage. Harmony also paused its bridge service, bridge.harmony.one, following the incident. The measure was intended to reduce the possibility of further movement of affected assets while the emergency response was underway. Emergency patch targets minting vulnerability. Harmony released an emergency software update designated v2026.1.1 and instructed validators to upgrade their nodes. The patch was designed to prevent the vulnerability from being exploited to create additional tokens. The blockchain project reported that 53% of its validators had completed the upgrade roughly four hours after the emergency patch was released. Harmony thanked validators and other participants for supporting the rapid response, while continuing to work on measures addressing the tokens that had already been minted. The distinction between stopping additional minting and resolving the existing supply increase remains significant. While the patch can prevent the same vulnerability from generating more tokens, it does not automatically remove the billions of ONE already created through the exploit. Rollback could reshape recent transactions. Harmony indicated that a blockchain rollback had emerged as the most practical solution under consideration. Such a move could potentially remove fraudulent transactions from the chain and restore the ledger to a state before the exploit occurred. However, a rollback could create complications for legitimate users. Transactions involving the affected tokens may have passed through exchanges or other wallets before the funds were identified. Reversing blockchain activity could therefore affect users who acquired the assets without knowing they were connected to the exploit. At the same time, leaving the fraudulent tokens in circulation could substantially dilute existing holders because the unauthorized minting increased the effective supply by billions of ONE. The rollback decision therefore represents a major trade-off: removing fraudulent activity could restore the intended token supply, while reversing transactions may also affect legitimate users who interacted with the blockchain after the exploit. Harmony has said it will provide additional details after evaluating the available options. Until a final resolution is reached, the project is relying on validator upgrades, exchange-level fund freezes and the suspension of its bridge to contain the incident. The exploit highlights the continuing security risks faced by blockchain networks, where a vulnerability affecting transaction processing or block validation can have immediate consequences for token supply, market prices and user funds. The incident also underscores the importance of rapid coordination among blockchain developers, validators and cryptocurrency exchanges when responding to large-scale security breaches. With the emergency patch preventing further fraudulent minting, Harmony's next major challenge is determining how to handle the approximately 4 billion previously created ONE tokens without causing unnecessary disruption to legitimate users.