Harmony Protocol: Unauthorized Event Led to Initial Minting of 4 Billion ONE

Harmony Protocol released an incident update confirming an unauthorized minting of ONE tokens. The project said its investigation found the attacker exploited a flaw in the cross-shard receipt double-validation mechanism, allowing previously processed cross-shard receipts to be executed again and minting ONE in empty blocks. The team is reconciling two sets of impact figures. Early analysis pointed to an initial issuance of 4 billion ONE. A more recent on-chain reconstruction indicates roughly 3.01 trillion ONE were minted via six forged cross-shard transactions to four attacker-controlled wallets. Harmony confirmed the initial 4 billion ONE mint came from two empty-block transactions—1 billion ONE and 3 billion ONE—followed by the transfer of 2.8 billion ONE to other attacker addresses. Harmony said it has patched the cross-shard receipt validation vulnerability and a pre-committee quorum verification issue, and has deployed Mainnet v2026.1.1. Bridge services remain suspended. The protocol is working with validators, exchanges, and LayerZero to freeze related funds, and is preparing a network rollback to block 92,730,034, prior to the attack. Shard 0 has been halted at block 92,753,555. As a result, official RPC endpoints may return 502 errors.