Key Takeaways
-
Harmony Protocol suffers exploit resulting in 2.385 trillion unauthorized ONE tokens minted on Aug. 12. -
ONE token price tumbled over 30% following the massive surge in unauthorized token supply. -
Developers, security teams, and law enforcement align to execute a blockchain rollback to Aug. 11.
Token Inflation
Developers behind the Harmony blockchain protocol announced Aug. 17 that they will execute a full network rollback to Aug. 11 following a security exploit that enabled an attacker to mint trillions of ONE tokens. According to a technical update released by the team, Harmony will roll back Shard 0 to block height 92,730,034 and Shard 1 to block height 94,978,278, effectively reverting the state of the blockchain to 23:25:37 UTC on Aug. 11, before the initial breach.
The incident began on Aug. 12 when an attacker exploited vulnerabilities in cross-shard receipt validation and quorum verification code to forge tokens. While early estimates identified an initial illicit minting of 4 billion ONE tokens, subsequent on-chain analysis revealed that a single wallet attempted 534 fraudulent transfers of 5 billion ONE each within a 106-second window. A total of 477 of those transactions succeeded, resulting in the unauthorized creation and transfer of 2.385 trillion ONE tokens.
The massive, unexpected surge in token supply triggered an immediate crash in the price of ONE, which dropped by more than 30% as billions of forged tokens were quickly routed to cryptocurrency exchanges.
Harmony developers deployed an emergency patch, Mainnet v2026.1.1, to prevent further unauthorized token creation, suspended cross-chain bridge services, and requested that cryptocurrency exchanges freeze wallet addresses linked to the exploit.
In Monday’s announcement, the project team stated it had evaluated alternative remedies—including targeted token burns, blacklisting specific address clusters, selective transaction replaying, and token migration—before concluding that a fixed-window rollback was the only solution that would not risk damaging unrelated funds or causing permanent chain state inconsistencies.
The team confirmed that over 99.9% of the forged token flows have been traced with the assistance of an independent security firm, and that law enforcement, bridge providers, and partner exchanges are coordinating on the recovery effort.
Under the rollback plan, network validators will adopt replacement databases starting at the target checkpoint blocks and begin regenerating new blocks from that point forward. Harmony, which was also hacked in 2022, noted that 141,628 consecutive blocks on Shard 0 generated between the rollback point and the network pause, containing 109,126 regular user transactions and 315 staking transactions, will be permanently discarded.
