An attacker minted approximately 4 billion ONE tokens on August 12, 2026, inflating Harmony's circulating supply by an estimated 26%. The exploit used empty blocks to bypass standard transfer alerts and smart-contract call monitoring, while the chain's totalSupply endpoint failed to register the ...
"I will not be tracking this incident and think no one should assist them for free." — ZachXBT, on-chain investigator, via X post on August 12, 2026
An attacker minted approximately 4 billion ONE tokens on August 12, 2026, inflating Harmony's circulating supply by an estimated 26%. The exploit used empty blocks to bypass standard transfer alerts and smart-contract call monitoring, while the chain's totalSupply endpoint failed to register the new issuance — masking the inflation long enough for roughly 2.8 billion ONE (97% of the minted total) to reach centralized exchanges before any freeze could take effect.
ONE fell from $0.00118 to $0.00056 within hours, a 52% intraday drop that pushed the token to a new all-time low. At the time of writing, ONE trades at approximately $0.000711, down 43% over seven days and 99.81% below its October 2021 all-time high of $0.38. Harmony's market cap has contracted to roughly $11 million, and its total value locked stands below $170,000.
The incident is the second major security failure on Harmony in four years, following the $100 million Horizon bridge hack in June 2022 that the FBI attributed to North Korea's Lazarus Group. Harmony is now evaluating a full blockchain rollback — a measure that would erase the unauthorized tokens but also reverse every legitimate transaction processed after the selected rollback point.
On-chain researcher Juiceberg identified the exploit mechanism on August 12, 2026. The attacker triggered unauthorized token creation through empty blocks — blocks that under normal operation carry no transactions. This vector allowed the mint to occur without generating the transfer events or contract calls that monitoring tools, exchanges, and validators typically use to flag abnormal activity.
Harmony's validator patch release notes for v2026.1.1 confirm the patch "closes two receipt verification flaws," indicating the exploit leveraged weaknesses in the chain's cross-shard receipt validation system. The attacker reportedly used forged receipts with zero signatures and a dead address to bypass the checks.
The total unauthorized issuance: approximately 4 billion ONE tokens. On-chain data shows the attacker distributed these across hundreds of wallets before funneling roughly 2.8 billion ONE to centralized exchanges. Harmony has not independently confirmed the exact figure, though the on-chain evidence reported by Juiceberg has not been disputed by the team.
Harmony published four implicated wallet addresses in a post at 1:25 AM ET on August 12 and asked exchanges to block and freeze funds traceable to those wallets. As of this writing, no exchange has publicly confirmed a freeze.
The exploit was made worse by a failure in Harmony's supply-reporting infrastructure. The chain's totalSupply endpoint — the API that data aggregators, exchanges, and price-tracking services use to determine circulating supply — did not update to reflect the newly minted tokens. The supply counter stayed frozen while 4 billion tokens entered circulation.
This supply masking gave the attacker a critical window. Without updated supply data, automated monitoring systems that track supply changes to detect minting anomalies had no signal to trigger on. By the time external analysts noticed the discrepancy via direct on-chain inspection, 97% of the minted tokens had already been deposited at exchanges.
The dual failure — exploitable minting mechanism plus non-reporting supply counter — points to a systemic problem rather than a single vulnerability. Both the consensus layer (which should have rejected the forged receipts) and the reporting layer (which should have reflected the new supply) failed simultaneously.
ONE's price trajectory following the exploit:
The token's market capitalization fell to approximately $11 million. For context, Harmony held over $1.4 billion in TVL at its 2022 peak. Current TVL: less than $170,000, according to aggregator data.
The price collapse was driven by the attacker offloading 2.8 billion ONE on exchanges. At pre-exploit prices, the minted tokens would have been worth approximately $4.7 million — a modest sum in absolute terms, but devastating relative to Harmony's thin liquidity and low market cap. The selling pressure represented roughly 26% dilution to existing holders who had no advance warning.
Harmony's response followed a sequence common to protocol-level exploits:
The patch closes two receipt verification flaws, but does not resolve the question of the 4 billion tokens already in circulation. That problem now sits with Harmony's rollback evaluation team and whatever coordination can be achieved with exchanges.
Harmony has indicated that a full blockchain rollback has emerged as "the most practical solution under consideration." A rollback would revert the chain's state to a point before the exploit, erasing the unauthorized minting from the network's canonical history.
The problems with this approach are substantial:
Legitimate transactions reversed. Every valid transfer, swap, stake, and unstake executed after the rollback point would be nullified. Users who received ONE through normal commerce would lose those funds. Users who sent ONE would see their balances restored but their counterparties deducted.
Exchange coordination required. With 2.8 billion ONE already deposited at exchanges and potentially sold, a rollback would create accounting mismatches between on-chain state and exchange ledgers. Any buyer who purchased ONE post-exploit and withdrew to their own wallet would hold tokens that the rollback declares never existed.
Validator consensus needed. The rollback requires sufficient validator participation to adopt the new chain state. As of the latest data, 53% had upgraded to the emergency patch. A rollback would require a fresh coordination effort with higher stakes.
Precedent risk. Chain rollbacks are rare and controversial. Ethereum's 2016 DAO hard fork remains the most prominent example, and it resulted in a permanent chain split (Ethereum/Ethereum Classic). Given Harmony's diminished validator set and community, the risk of a contentious split may be lower, but the precedent for protocol governance is set regardless.
This is not Harmony's first catastrophic security failure. On June 23, 2022, the Horizon bridge was exploited for approximately $100 million. The bridge operated as a 2-of-5 multisig — an attacker who compromised two private keys could drain the entire bridge. The FBI later attributed the attack to North Korea's Lazarus Group.
In 2023, a separate bug improperly minted approximately 146.3 million ONE tokens, though the impact was comparatively minor.
The pattern is clear: three security incidents in four years, each exploiting a different layer of the protocol (bridge multisig, token minting, cross-shard receipt validation). The recurrence raises questions about Harmony's internal security review processes, audit coverage, and engineering capacity.
Harmony's TVL trajectory tells the economic story. From over $1.4 billion in 2022 to under $170,000 today, the protocol has lost effectively all economic activity. The August 2026 exploit is occurring on a chain that was already operating at the margin of viability.
On-chain investigator ZachXBT publicly refused to assist with the investigation, posting: "I will not be tracking this incident and think no one should assist them for free." He urged other researchers to boycott the effort.
The reason, according to ZachXBT: following the 2022 Horizon bridge hack, Harmony "took advantage of people who assisted" in tracking and freezing stolen funds. White-hat investigators who voluntarily contributed to freezing assets — work that later facilitated law enforcement seizures — received no compensation. ZachXBT stated Harmony rewarded these contributors with "$0" and "simply said 'good job.'"
Coin Bureau amplified the boycott call, posting ZachXBT's statement to its followers. The public refusal highlights a structural problem in crypto security incident response: protocols rely on volunteer investigators for post-exploit triage but have no standardized compensation framework for their work.
The economic logic is straightforward. If protocols do not pay for post-exploit investigative work, the supply of willing investigators decreases. The cost of future exploits rises accordingly.
Harmony's trajectory illustrates several principles about economic value distribution in blockchain ecosystems:
Validator economics without economic activity are unsustainable. With TVL below $170,000 and a market cap of $11 million, the economic incentive for validators to secure the chain approaches zero. Thin validator economics correlate with security degradation — the cost to exploit the chain drops faster than the value of what remains on it.
Security is an ongoing capital expenditure, not a one-time audit. The three distinct exploit vectors across four years (bridge multisig, minting bug, cross-shard receipt validation) indicate that Harmony's security posture was not maintained as the protocol evolved. Each vulnerability existed in a different subsystem, suggesting insufficient coverage rather than a single architectural flaw.
Supply integrity is infrastructure. The totalSupply endpoint failure demonstrates that supply reporting is a critical piece of market infrastructure. When the supply counter lies — or fails to update — the entire downstream stack (exchanges, aggregators, pricing feeds) operates on false data. This is functionally equivalent to an oracle failure.
The white-hat investigator market is underpriced. ZachXBT's boycott is a pricing signal. The market for post-exploit investigative labor has been subsidized by volunteer goodwill. When that goodwill is exhausted — as it now has been for Harmony — the protocol has no fallback.
The Harmony exploit is a case study in compounding failure. A protocol-level minting vulnerability was made worse by a reporting-layer failure that masked the inflation. The attacker's ability to move 97% of minted tokens to exchanges before detection indicates that Harmony's monitoring infrastructure was functionally non-existent for this attack vector.
The proposed rollback may address the supply inflation but introduces its own set of economic dislocations. Every legitimate transaction after the exploit timestamp becomes collateral damage. Whether validators and exchanges can coordinate a clean rollback on a chain with $11 million in market cap and fewer than 170,000 dollars in TVL remains an open question.
The broader signal is about infrastructure decay. When a chain's economic activity drops below the threshold needed to fund adequate security engineering, audit coverage, and monitoring — the vulnerability surface expands while the resources to defend it shrink. Harmony crossed that threshold long before August 12.