Harmony Ships an Emergency Patch and Pauses Its Bridge

Harmony spent 12 August in containment mode. At 12:26 AM ET the network confirmed on X what an on-chain observer had flagged hours earlier: someone had minted ONE tokens out of nothing through the chain's cross-shard messaging. An hour later Harmony published four attacker addresses and asked exchanges to freeze anything traceable. During the day it shipped an emergency validator patch, mainnet v2026.1.1, and paused the Horizon bridge at bridge.harmony.one as a precaution. What it did not publish was a confirmed figure for how much ONE the attacker created.

Two flaws, one patch

The exploit itself ran late Tuesday, a 106-second forged mint first detected at block 92,730,036 on Shard 0. Per the patch notes, v2026.1.1 closes two defects in receipt verification, the process by which one shard proves to another that a transfer really happened. The first defect let receipts carrying empty signer records, or mathematically neutral signatures, pass quorum checks. The second left proof fields unbound to signed block headers, so a receipt that had already been processed could be replayed as new. Either would be serious alone. Together they let the attacker credit tokens on one shard that were never debited anywhere.

Adoption ran fast. More than half of the validator set was running the new release within hours.

Four wallets, no confirmed total

The addresses flagged at 1:25 AM ET split evenly, two native ONE wallets and two on Ethereum. How much exchanges have actually frozen is undisclosed. The size of the mint is murkier still. Juiceberg, the analyst who first flagged the attack at about 9:42 PM ET on Tuesday, estimated roughly 4 billion ONE, about 26% of a circulating supply near 15 billion, with around 70% of that reaching exchanges. TechTimes reported that roughly 97% of the forged tokens hit exchange wallets before any freeze could land, helped by the chain's totalSupply endpoint failing to show the new tokens in real time. Harmony had not confirmed any of these figures by Wednesday evening. The estimate stands unverified.

The bridge goes dark

Pausing Horizon closes the network's main route to other chains while the accounting is unsettled. Harmony described the move as precautionary. The market did its own math regardless: ONE fell more than 30% to an all-time low of $0.0005735 before recovering to about $0.00077, for a market value trackers put between $11.2 million and $11.5 million. Forged supply is not a new failure mode this summer. A stolen owner key minted 5.23 million WEMIX$ in July, but that was a custody failure at one project. Harmony's flaw sat in the consensus layer of the chain itself.

A rollback is on the table

CryptoSlate reported Wednesday that Harmony was weighing a full rollback of the chain to its pre-exploit state, one option among several under review. No decision had been announced at the time of writing. The distinction matters, because v2026.1.1 stops new forgeries and does nothing about tokens already minted, wherever they now sit. Three disclosures would firm the picture up: a confirmed mint total from Harmony, freeze figures from the exchanges holding forged ONE, and a plan for the chain state itself. None of the three existed by Wednesday night.