An unauthorized minting of 4 billion ONE tokens occurred on Harmony Mainnet around August 12, 2026 at 05:25 UTC, the protocol said in an announcement. The team deployed an emergency patch, version 2026.1.1, the same day.
The exploit triggered cross-shard transaction forgeries on Shard 0 at block 92,730,036, according to Harmony's account. The protocol is still reconciling conflicting impact measurements; an initial analysis showed a first-wave mint of 4 billion ONE via two empty-block credits, while a later chain-level reconstruction identified 3.01 trillion ONE moved across six forged transactions into four exploiter wallets. Harmony said it would reconcile these figures in a subsequent report.
Harmony is a layer-one blockchain focused on sharded architecture and cross-shard communication. ONE trades on major exchanges; the token's supply before the exploit stood at roughly 12.6 billion. The 4 billion unauthorized tokens represent a 31.7 percent increase to circulating supply if all minted tokens entered the market.
The protocol said exploiter wallets sent approximately 97 million ONE across multiple exchanges following the initial mint, according to analysis. A full blockchain rollback was under consideration as a mitigation option, though Harmony did not confirm whether such a reset would occur.
Minting exploits are uncommon on established blockchains because they require tampering with core consensus logic. Harmony's sharded design, which splits validator sets across multiple shards to boost throughput, creates additional complexity in cross-shard transaction validation. The August 12 incident hit that intersection.
Emergency patches typically pause affected functionality or freeze state at a prior block height. Harmony's v2026.1.1 was deployed hours after discovery, which compressed the window for further unauthorized mints but did not undo tokens already issued. The protocol's ability to execute a full rollback depends on validator coordination and whether major exchange deposits from exploiter wallets had already been processed into withdrawals.
