Harmony Protocol Confirms Initial 4 Billion ONE Minted in Unauthorized Event

ChainCatcher report: Harmony Protocol has issued an incident update stating that an unauthorized minting of ONE tokens occurred. The investigation revealed that the attacker exploited a vulnerability in the cross-shard receipt double-validation mechanism, causing previously processed cross-shard receipts to be re-executed and ONE tokens to be minted in empty blocks. The team is currently verifying two sets of impact data: early analysis indicated an initial minting of 4 billion ONE, while the latest on-chain reconstruction shows approximately 3.01 trillion ONE were issued across six forged cross-shard transactions to four attacker wallets. Harmony Protocol confirms the initial minting of 4 billion ONE, generated through two empty-block transactions of 1 billion and 3 billion ONE respectively, followed by the transfer of 2.8 billion ONE to other attacker addresses. The team has patched the vulnerabilities in cross-shard receipt validation and pre-committee quorum verification, and deployed Mainnet v2026.1.1. Bridge services have been suspended; Harmony Protocol is coordinating with validators, exchanges, and LayerZero to freeze related funds and is preparing to roll back the network to block 92,730,034 prior to the attack. Shard 0 has been halted at block 92,753,555, and official RPC endpoints may return 502 errors as a result.