Harmony ONE Hack Explained: How 4B Tokens Got Minted

TLDR

On August 12, 2026, an attacker minted approximately 4 billion ONE tokens on Harmony, inflating the network's supply of roughly 15 billion by about 26% in a single incident. An independent on-chain analyst flagged the mint publicly before Harmony confirmed it, reporting that the tokens were created through empty blocks and that Harmony's totalSupply endpoint did not reflect the new tokens, so explorers and dashboards reading it kept showing the pre-exploit supply while the tokens moved. The root cause, identified in a public analysis the same day, was a quorum verification bug: Harmony's consensus code counted the public keys listed in a signature mask rather than the validators that actually signed, so messages carrying no valid signatures at all passed the quorum threshold. By the time the mint was public, about 97% of the minted ONE sat in exchange deposit wallets or had already been sold. ONE fell as much as 40% on the day to around $0.0008, valuing the minted tokens at roughly $3.2 million at post-crash prices. Harmony paused its token bridge, shipped an emergency validator build that prevents further minting, asked exchanges to freeze two attacker wallets, and said it is evaluating a rollback. By August 17 that had firmed into a proposed restart from pre-exploit checkpoints, covered in the update below.

Technical Analysis

The root cause was a broken quorum check in Harmony's consensus code, identified in a public analysis of the vulnerable routine the day the exploit ran. Harmony finalizes blocks with aggregated BLS signatures: a signature mask records which committee members contributed to the aggregate, and a verifier is supposed to confirm that enough of them actually signed. The vulnerable verifier instead measured the size of the key roster attached to the mask:

func (uv *uniformVerifier) IsQuorumAchievedByMask(mask *bls_cosi.Mask) bool {
	got := int64(len(mask.Publics))
	exp := uv.thresholdKeyCount()
	return got > exp
}

mask.Publics is the list of public keys the mask covers, not the subset that signed, so every listed key counted as a signer whether it had signed or not. A message carrying a long enough key list cleared the threshold with zero valid signatures; a mask full of validators who never signed verified as a full quorum. The property that makes a BFT chain's history authoritative reduced to a length check on attacker-supplied data.

With quorum forgeable, the attacker could have the network accept consensus messages no validator ever signed. The mint surfaced on-chain as empty blocks, blocks carrying no user transactions that credited freshly created ONE to attacker-controlled addresses, consistent with forged consensus data driving native issuance directly rather than any smart contract call. That is also why the remediation shipped as an emergency validator build rather than a contract patch.

The second failure compounded the first: the mint was not visible where anyone was looking. Harmony's totalSupply endpoint continued to report the pre-exploit figure, so supply dashboards, explorers, and any alerting keyed to reported supply saw nothing unusual while 4 billion unauthorized tokens entered circulation and flowed to exchanges. Detection ultimately came from an outside analyst comparing actual chain state against the reported number, not from the project's own telemetry.

Unauthorized native-token minting on Harmony has precedent. In December 2023, a bug improperly created about 146.28 million ONE. The August 2026 incident is roughly 27 times larger and differs in kind: the December 2023 issuance was a malfunction, while this mint was directed to specific wallets and immediately routed toward liquidity.

The incident landed five days after Ravencoin's consensus exploit forced that network toward a multi-day rollback, making it the second chain-level integrity failure in a week — a class of attack absent from the ten biggest DeFi hacks of 2026, which are dominated by compromised infrastructure and stolen keys. Both incidents share the same uncomfortable property: when the failure is in the chain itself rather than a contract deployed on it, there is no pausable contract or upgradeable proxy, and the response options narrow to emergency client releases and history rewrites.

Impact Assessment

The direct economic damage is dilution, and it was distributed to every ONE holder at once. Four billion unauthorized tokens against a supply of roughly 15 billion is 26% inflation, and the market repriced it immediately: ONE fell between 30% and 40% across the day, trading near $0.0008 and cutting the token's market capitalization to about $11.5 million. At post-crash prices the minted tokens were worth roughly $3.2 million; at pre-exploit prices the figure was meaningfully higher.

The attacker moved quickly enough that most of the minted supply left their hands before any freeze could bite. About 97% of the minted ONE had reached exchange deposit wallets or been sold by the time the incident was public, with roughly 115 million ONE, about 2.9% of the minted amount, still held on-chain for over-the-counter or DEX sales. Exchanges that credited deposits of unauthorized tokens and allowed them to be sold against real assets now hold the loss unless a rollback or coordinated freeze claws it back.

Harmony asked exchanges to freeze funds from two wallets linked to the incident, each identified in both Harmony bech32 and hex form:

one1uap8dx2z0qsjxqthm5flgcxkeepsz3gsrghnfn (0xe7427699427821230177dd13f460d6ce43014510)
one17u300a40ll5wphd8kj5hktryhdjq3ml9f4phy4 (0xf722f7f6afffe8e0dda7b4a97b2c64bb6408efe5)

Response and Recovery

Harmony confirmed the exploit the same day, stating it was working with its team and the relevant exchanges to stop and freeze the funds. The token bridge was paused roughly five hours after the first public alert, and minutes after the pause Harmony released a build to validators that it said prevents any further minting. The team said a separate update will address the tokens already created, and that it is evaluating additional measures including a rollback of the chain to neutralize the fraudulently issued supply, a step many in the industry consider a last resort because of what it does to settlement finality.

Update — August 17, 2026: Harmony's core team has proposed a rollback plan but not yet executed it. Under the proposal, validators keep shard 0 block 92,730,034 and shard 1 block 94,978,278, both sealed at 23:25:37 UTC on August 11, and restart the network from databases rebuilt around those checkpoints. The cut point leaves a one-block safety buffer: the first forged mint landed at shard 0 block 92,730,036, and the block before it was empty. Discarding post-checkpoint history erases 109,126 regular transactions and 315 staking transactions, though about 96% of the regular activity was automated, mostly DEX bots. On-chain reconstruction also showed forged issuance far beyond the 4 billion first reported: one wallet alone pushed 2.385 trillion forged ONE through 477 transfers in 106 seconds. Client v2026.1.2 is configured to reject the abnormal block hashes so validators cannot re-accept the discarded chain after restart, and Harmony says it is working with exchanges, bridges, and law enforcement to preserve records and assess the effect of discarding post-checkpoint activity. No restart date has been announced.

The freeze-and-rollback playbook is familiar territory for Harmony. The project's Horizon bridge lost about $100 million in June 2022 in an attack the FBI later attributed to North Korea's Lazarus Group, one of the validator-compromise incidents that made bridges the weakest link in DeFi. This time the failure was not at the network's edge but in its core issuance path.

The detection gap is the operational lesson. Supply-keyed telemetry silently failed while a quarter of the network's supply was minted and moved, and the incident became known only when an outside analyst compared real chain state against the reported figure. Monitoring that watches what actually executes on-chain rather than what an API reports is exactly what closes this class of gap; Defimon's structured WebSocket alerts exist so exchanges and trading desks can freeze deposits of anomalously minted or drained funds within seconds of the transactions confirming, not hours later when the news breaks.

Frequently Asked Questions

What happened to Harmony ONE?

On August 12, 2026, an attacker minted about 4 billion unauthorized ONE tokens on Harmony, inflating the supply of roughly 15 billion by about 26%. Harmony's totalSupply endpoint did not reflect the new tokens, and about 97% of them reached exchange deposit wallets or were sold before the incident was public. ONE fell as much as 40% to around $0.0008. Harmony paused its bridge, shipped an emergency validator build that prevents further minting, asked exchanges to freeze two attacker wallets, and is evaluating a rollback.

How did the attacker mint 4 billion ONE tokens?

Through a quorum verification bug in Harmony's consensus code. Harmony finalizes blocks with aggregated BLS signatures, and a signature mask records which committee members contributed. The vulnerable check counted every public key listed in the mask as a signer instead of counting who actually signed, so consensus messages carrying no valid signatures passed the quorum threshold. The attacker used forged quorum data to mint ONE through empty blocks, blocks with no user transactions that credited fresh tokens to attacker addresses, and the chain's totalSupply endpoint failed to reflect the minted tokens, hiding the inflation from dashboards while the tokens moved to exchanges.

Will Harmony roll back its blockchain?

Harmony's core team has proposed a rollback but, as of August 17, 2026, has not executed it. Validators would keep shard 0 block 92,730,034 and shard 1 block 94,978,278, both sealed at 23:25:37 UTC on August 11, and restart the network from databases rebuilt around those checkpoints, one empty block before the first forged mint. About 109,000 regular transactions and 315 staking transactions after the checkpoints would be discarded, roughly 96% of them automated DEX bot activity, and client v2026.1.2 rejects the abnormal block hashes so the discarded history cannot be re-accepted. No restart date has been announced.

Has Harmony been hacked before?

Yes. Harmony's Horizon bridge lost about $100 million in June 2022, an attack the FBI attributed to North Korea's Lazarus Group. In December 2023, a bug improperly created about 146.28 million ONE. The August 2026 incident is far larger than the 2023 mint and hit the network's core issuance path rather than its bridge.

Harmony 4 Billion ONE Unauthorized Mint Exploit