Harmony Protocol Confirms 4 Billion ONE Minted in Unauthorized Attack, Prepares Network Rollback

Odaily Planet Daily reports that Harmony Protocol has issued an incident update regarding an unauthorized ONE minting event on August 12. The investigation revealed that the attacker exploited a vulnerability in cross-shard receipt replay, causing previously processed cross-shard receipts to be re-executed and ONE tokens to be minted in empty blocks. The team is currently verifying two sets of impact data: early analysis indicated an initial minting of 4 billion ONE, while the latest on-chain reconstruction shows approximately 3.01 trillion ONE were issued across six forged cross-shard transactions to four attacker wallets. Harmony Protocol confirms the initial minting of 4 billion ONE, generated through two empty block transactions of 1 billion and 3 billion ONE respectively, followed by the transfer of 2.8 billion ONE to other attacker addresses. The team has patched the vulnerabilities in cross-shard receipt validation and pre-committee quorum verification, and deployed Mainnet v2026.1.1 on August 12 at 06:30 UTC. Bridge services have been suspended; Harmony Protocol is coordinating with validators, exchanges, and LayerZero to freeze related funds and is preparing to roll back the network to block 92,730,034 prior to the attack. Shard 0 has been paused at block 92,753,555, and official RPC endpoints may return 502 errors as a result.