Harmony Protocol to Roll Back Network After Exploit Mints 2.385 Trillion ONE Tokens

Harmony Protocol will roll back its blockchain to Aug. 11 after a security incident that allowed an attacker to mint 2.385 trillion ONE tokens. The project's developers said on Aug. 17 that the rollback will revert the chain to 23:25:37 UTC on Aug. 11, prior to the breach. Per the team's technical update, Shard 0 will be rolled back to block height 92,730,034 and Shard 1 to block height 94,978,278. The attack occurred on Aug. 12, exploiting weaknesses in cross-shard receipt validation and quorum verification to forge tokens. Initial estimates pointed to 4 billion ONE minted illicitly. Subsequent on-chain analysis found a single wallet attempted 534 fraudulent transfers of 5 billion ONE each within 106 seconds. Of those, 477 transactions succeeded, leading to the unauthorized creation and transfer of 2.385 trillion ONE. The sudden jump in supply sent ONE down more than 30% as forged tokens were quickly moved to cryptocurrency exchanges. Harmony said it deployed an emergency patch, Mainnet v2026.1.1, to stop further unauthorized minting, suspended cross-chain bridge services, and asked exchanges to freeze addresses tied to the exploit. The team said it assessed other responses—including targeted token burns, blacklisting address clusters, selective transaction replay, and token migration—but concluded a fixed-window rollback was the only option that avoided risking unrelated funds or creating lasting inconsistencies in chain state. Harmony said more than 99.9% of forged-token flows have been traced with help from an independent security firm, and that law enforcement, bridge providers, and partner exchanges are coordinating recovery efforts. Under the plan, validators will switch to replacement databases beginning at the checkpoint blocks and resume block production from that point. Harmony, which was also hacked in 2022, said 141,628 consecutive blocks on Shard 0 produced between the rollback point and the network pause—covering 109,126 regular user transactions and 315 staking transactions—will be permanently discarded.