Harmony Protocol Says 4B ONE Were Illegally Minted, Plans Chain Rollback After Cross-Shard Exploit

Harmony Protocol released an incident update on an unauthorized ONE minting event that occurred on Aug. 12, Odaily Planet Daily reported. The probe found the attacker abused a cross-shard receipt replay flaw, allowing already-processed cross-shard receipts to be executed again and minting ONE into empty blocks. The team is reconciling two sets of impact estimates. An early review pointed to 4 billion ONE minted, while a newer on-chain reconstruction suggests roughly 3.01 trillion ONE were created via six forged cross-shard transactions sent to four attacker wallets. Harmony Protocol said it has confirmed the 4 billion ONE figure for the initial mint, produced through two empty-block transactions that created 1 billion and 3 billion ONE, respectively. It added that 2.8 billion ONE were subsequently transferred to additional attacker-controlled addresses. Harmony said it has patched issues in cross-shard receipt validation and precommittee quorum verification, and deployed Mainnet v2026.1.1 at 06:30 UTC on Aug. 12. Bridge services remain suspended. The protocol is working with validators, exchanges and LayerZero to freeze related funds and is preparing to roll back the network to block 92,730,034, before the attack. Shard 0 has been paused at block 92,753,555, and official RPC endpoints may return 502 errors as a result.