Harmony Releases Probe Results of ONE Abnormal Minting Incident: Confirms 4 Billion ONE Tokens Minted in the First Round, Vulnerability Fixed, Rollback Prepared

Harmony Protocol has issued an event update confirming an unauthorized ONE minting incident on August 12. Investigations reveal the attacker exploited a cross-shard receipt duplicate verification vulnerability, re-executing processed cross-shard receipts to mint ONE out of thin air in empty blocks. The team is verifying two sets of impact data: initial analysis pointed to an initial mint of 4 billion ONE, while latest on-chain reconstruction shows approximately 3.01 trillion ONE was issued to four attacker wallets via six forged cross-shard transactions. Harmony has confirmed the initial 4 billion ONE mint, generated via two empty block records: 1 billion and 3 billion ONE respectively. Of that amount, 2.8 billion ONE was subsequently transferred to other attacker addresses. The team has patched the cross-shard receipt verification and pre-staking committee quorum verification vulnerabilities, and deployed Mainnet v2026.1.1 at 06:30 UTC on August 12. The bridge service has been suspended. Harmony is now coordinating with validators, exchanges, and LayerZero to freeze related funds, and preparing to roll back the network to block 92,730,034, the state before the attack. Currently, Shard 0 is suspended at block 92,753,555, which may cause official RPC to return 502 errors.