# Harmony 4 Billion ONE Unauthorized Mint Exploit

> An attacker minted about 4 billion ONE, inflating Harmony's supply by roughly 26%, while a masked totalSupply reading delayed detection and 97% of the tokens reached exchanges before any freeze.

Source: https://defimon.xyz/blog/harmony-hack-august-2026 · Published: 2026-08-12 · Network: Harmony

---

## TLDR

On August 12, 2026, an attacker minted approximately 4 billion ONE tokens on Harmony, inflating the network's supply of roughly 15 billion by about 26% in a single incident. An independent on-chain analyst flagged the mint publicly before Harmony confirmed it, reporting that the tokens were created through empty blocks and that Harmony's totalSupply endpoint did not reflect the new tokens, so explorers and dashboards reading it kept showing the pre-exploit supply while the tokens moved. The root cause, identified in a public analysis the same day, was a quorum verification bug: Harmony's consensus code counted the public keys listed in a signature mask rather than the validators that actually signed, so messages carrying no valid signatures at all passed the quorum threshold. By the time the mint was public, about 97% of the minted ONE sat in exchange deposit wallets or had already been sold. ONE fell as much as 40% on the day to around $0.0008, valuing the minted tokens at roughly $3.2 million at post-crash prices. Harmony paused its token bridge, shipped an emergency validator build that prevents further minting, asked exchanges to freeze two attacker wallets, and said it is evaluating a rollback.

## Technical Analysis

The root cause was a broken quorum check in Harmony's consensus code, identified in [a public analysis](https://x.com/danielvf/status/2087501568362864680) of the vulnerable routine the day the exploit ran. Harmony finalizes blocks with aggregated BLS signatures: a signature mask records which committee members contributed to the aggregate, and a verifier is supposed to confirm that enough of them actually signed. The vulnerable verifier instead measured the size of the key roster attached to the mask:

```go
func (uv *uniformVerifier) IsQuorumAchievedByMask(mask *bls_cosi.Mask) bool {
	got := int64(len(mask.Publics))
	exp := uv.thresholdKeyCount()
	return got > exp
}
```

`mask.Publics` is the list of public keys the mask covers, not the subset that signed, so every listed key counted as a signer whether it had signed or not. A message carrying a long enough key list cleared the threshold with zero valid signatures; a mask full of validators who never signed verified as a full quorum. The property that makes a BFT chain's history authoritative reduced to a length check on attacker-supplied data.

With quorum forgeable, the attacker could have the network accept consensus messages no validator ever signed. The mint surfaced on-chain as empty blocks, blocks carrying no user transactions that credited freshly created ONE to attacker-controlled addresses, consistent with forged consensus data driving native issuance directly rather than any smart contract call. That is also why the remediation shipped as an emergency validator build rather than a contract patch.

The second failure compounded the first: the mint was not visible where anyone was looking. Harmony's totalSupply endpoint continued to report the pre-exploit figure, so supply dashboards, explorers, and any alerting keyed to reported supply saw nothing unusual while 4 billion unauthorized tokens entered circulation and flowed to exchanges. Detection ultimately came from an outside analyst comparing actual chain state against the reported number, not from the project's own telemetry.

Unauthorized native-token minting on Harmony has precedent. In December 2023, a bug improperly created about 146.28 million ONE. The August 2026 incident is roughly 27 times larger and differs in kind: the December 2023 issuance was a malfunction, while this mint was directed to specific wallets and immediately routed toward liquidity.

The incident landed five days after [Ravencoin's consensus exploit](/blog/ravencoin-hack-august-2026) forced that network toward a multi-day rollback, making it the second chain-level integrity failure in a week. Both incidents share the same uncomfortable property: when the failure is in the chain itself rather than a contract deployed on it, there is no pausable contract or upgradeable proxy, and the response options narrow to emergency client releases and history rewrites.

## Impact Assessment

The direct economic damage is dilution, and it was distributed to every ONE holder at once. Four billion unauthorized tokens against a supply of roughly 15 billion is 26% inflation, and the market repriced it immediately: ONE fell between 30% and 40% across the day, trading near $0.0008 and cutting the token's market capitalization to about $11.5 million. At post-crash prices the minted tokens were worth roughly $3.2 million; at pre-exploit prices the figure was meaningfully higher.

The attacker moved quickly enough that most of the minted supply left their hands before any freeze could bite. About 97% of the minted ONE had reached exchange deposit wallets or been sold by the time the incident was public, with roughly 115 million ONE, about 2.9% of the minted amount, still held on-chain for over-the-counter or DEX sales. Exchanges that credited deposits of unauthorized tokens and allowed them to be sold against real assets now hold the loss unless a rollback or coordinated freeze claws it back.

Harmony asked exchanges to freeze funds from two wallets linked to the incident, each identified in both Harmony bech32 and hex form:

- one1uap8dx2z0qsjxqthm5flgcxkeepsz3gsrghnfn (0xe7427699427821230177dd13f460d6ce43014510)
- one17u300a40ll5wphd8kj5hktryhdjq3ml9f4phy4 (0xf722f7f6afffe8e0dda7b4a97b2c64bb6408efe5)

## Response and Recovery

Harmony confirmed the exploit the same day, stating it was working with its team and the relevant exchanges to stop and freeze the funds. The token bridge was paused roughly five hours after the first public alert, and minutes after the pause Harmony released a build to validators that it said prevents any further minting. The team said a separate update will address the tokens already created, and that it is evaluating additional measures including a rollback of the chain to neutralize the fraudulently issued supply, a step many in the industry consider a last resort because of what it does to settlement finality.

The freeze-and-rollback playbook is familiar territory for Harmony. The project's Horizon bridge lost about $100 million in June 2022 in an attack the FBI later attributed to North Korea's Lazarus Group, one of the validator-compromise incidents that made [bridges the weakest link in DeFi](/blog/bridge-exploits-explained). This time the failure was not at the network's edge but in its core issuance path.

The detection gap is the operational lesson. Supply-keyed telemetry silently failed while a quarter of the network's supply was minted and moved, and the incident became known only when an outside analyst compared real chain state against the reported figure. Monitoring that watches what actually executes on-chain rather than what an API reports is exactly what closes this class of gap; Defimon's [structured WebSocket alerts](/docs/websocket_attack_message) exist so exchanges and trading desks can freeze deposits of anomalously minted or drained funds within seconds of the transactions confirming, not hours later when the news breaks.

## Frequently Asked Questions

### What happened to Harmony ONE?

On August 12, 2026, an attacker minted about 4 billion unauthorized ONE tokens on Harmony, inflating the supply of roughly 15 billion by about 26%. Harmony's totalSupply endpoint did not reflect the new tokens, and about 97% of them reached exchange deposit wallets or were sold before the incident was public. ONE fell as much as 40% to around $0.0008. Harmony paused its bridge, shipped an emergency validator build that prevents further minting, asked exchanges to freeze two attacker wallets, and is evaluating a rollback.

### How did the attacker mint 4 billion ONE tokens?

Through a quorum verification bug in Harmony's consensus code. Harmony finalizes blocks with aggregated BLS signatures, and a signature mask records which committee members contributed. The vulnerable check counted every public key listed in the mask as a signer instead of counting who actually signed, so consensus messages carrying no valid signatures passed the quorum threshold. The attacker used forged quorum data to mint ONE through empty blocks, blocks with no user transactions that credited fresh tokens to attacker addresses, and the chain's totalSupply endpoint failed to reflect the minted tokens, hiding the inflation from dashboards while the tokens moved to exchanges.

### Will Harmony roll back its blockchain?

Harmony said it is evaluating rollback options but has not committed to one. The validator build it released stops further minting, and the team said a separate update will deal with the roughly 4 billion tokens already created. A rollback would rewrite recent history to erase the mint, which also reverses every legitimate transaction confirmed since the exploit, so it is widely treated as a last resort.

### Has Harmony been hacked before?

Yes. Harmony's Horizon bridge lost about $100 million in June 2022, an attack the FBI attributed to North Korea's Lazarus Group. In December 2023, a bug improperly created about 146.28 million ONE. The August 2026 incident is far larger than the 2023 mint and hit the network's core issuance path rather than its bridge.