Harmony Protocol Confirms Unauthorized Mint of 400M ONE, Plans Network Rollback

Harmony Protocol said in an incident update on Aug. 14 (UTC+8) that unauthorized minting of ONE tokens occurred on Aug. 12. The project's investigation attributes the incident to a cross-shard receipt replay flaw, which allowed previously processed cross-shard receipts to be executed again, minting ONE into empty blocks. The team is reconciling two impact estimates. Early analysis pointed to 4 billion ONE minted, while a newer on-chain reconstruction suggests roughly 3.01 trillion ONE may have been created across six forged cross-shard transactions to four attacker-controlled wallets. Harmony said it has confirmed an initial mint of 4 billion ONE, produced through two empty-block transactions of 1 billion ONE and 3 billion ONE, followed by transfers totaling 2.8 billion ONE to additional attacker addresses. Harmony said it has patched issues in cross-shard receipt validation and pre-staking quorum verification, and deployed Mainnet v2026.1.1 at 06:30 UTC on Aug. 12. Bridge services remain suspended. The protocol is working with validators, exchanges and LayerZero to freeze related funds, and is preparing to roll back the network to block 92,730,034, prior to the attack. Shard 0 has been paused at block 92,753,555, and official RPC endpoints may return 502 errors. (Source: ODAILY)