Harmony released an emergency software update for its validators on August 12, 2026, to stop a protocol exploit that allowed unauthorized creation of its native ONE token. The team also paused its cross-chain bridge and asked exchanges to freeze funds linked to four specific wallet addresses involved in the incident.
Onchain researcher Juiceberg estimates that roughly 4 billion ONE tokens were minted without permission, with about 2.8 billion already reaching trading platforms. Harmony is now considering a full network rollback to erase the excess supply, though it has not yet confirmed the final amount or a specific point for reversing the chain history.
Key facts
- Harmony deployed validator patch v2026.1.1 to fix two cross-shard receipt vulnerabilities that enabled empty signer records and replayed proofs.
- Researcher Juiceberg estimates 4 billion ONE tokens were minted illicitly, representing approximately 26% of the supply figure cited in recent reports.
- About 2.8 billion of the unauthorized tokens have reportedly moved to cryptocurrency exchanges.
- The project paused bridge.harmony.one during its response and published four wallet addresses for tracking.
- Harmony has not confirmed the exact volume of excess tokens or announced a definitive plan for a blockchain rollback.
Why it matters
A potential rollback represents a rare and significant intervention in a public blockchain, aimed at preserving token scarcity and market integrity. Users and traders face uncertainty regarding asset validity and exchange liquidity while the network determines how to handle billions in unauthorized tokens. The incident highlights critical risks in cross-shard communication mechanisms and the operational challenges of responding to large-scale protocol exploits.