Harmony released mainnet patch v2026.1.1 on Aug. 12 after reports that ONE had been minted without authorization, changing two verification paths tied to a pre-staking-epoch quorum check and a cross-shard receipt flow that could let the same transfer be applied more than once.
Before the release, Harmony said it was working with exchanges to freeze funds, preparing a patch, and evaluating rollback options. It later said it had identified four wallets for exchanges to block and had paused its bridge.
For token holders and exchanges, the patch gives a clearer technical account of how ONE balances could be created without a matching debit on the source side. What it does not do is settle the size of the disputed issuance or define what a rollback would touch. The release and the Harmony posts cited alongside it do not name a rollback point, do not quantify the disputed supply, and do not say which transactions would be affected.
Onchain account Juiceberg said 4 billion ONE, or about 26% of supply, had been created and that 2.8 billion ONE had been sent to exchanges. Harmony quoted that post in its initial response, but it did not present those figures as its own conclusions.
CoinGecko showed ONE trading at about $0.000773, down 37.6% over 24 hours. The data provider listed both circulating supply and total supply at 14.87 billion ONE.
The patch describes two verification failures
Harmony’s release notes include one changelog line, “Cx receipt fixes main,” and link to pull request #5101, which outlines two code changes.
The first issue involved quorum calculation for pre-staking-epoch committees. The verifier compared the full committee size against the threshold instead of counting the validators enabled in the signer bitmap. According to the pull request, that meant an all-zero bitmap combined with an all-zero identity aggregate BLS signature could satisfy quorum for those committees.
The fix now counts enabled bitmap entries and rejects a nil mask. The pull request also adds a test requiring the verification engine to reject an empty pre-staking quorum.
The second flaw involved cross-shard receipts, which are the records used to credit assets arriving from another Harmony shard. For receipts from older epochs, the marker used to show that a receipt had already been spent relied on proof fields that were not authenticated against the signed block header.
That opened a replay path. A genuine receipt that had already been applied could be resubmitted with altered proof identifiers, and each replay could appear unspent. In the pull request’s wording, Harmony’s code could then “credit the destination again with no corresponding source debit.”
The update now derives the spent marker from the signed header. The pull request changes validation and accounting logic, but it does not include a rollback of previously accepted state.
The 4 billion ONE figure is still an outside estimate
Harmony’s staking API reported total supply of 15.3297 billion ONE and circulating supply of 15.0105 billion at epoch 3003. The endpoint has no field that isolates disputed or replayed balances, so it does not resolve how much unauthorized ONE exists.
The 4 billion ONE estimate works out to roughly 26% of the total supply shown by the staking API, matching Juiceberg’s percentage claim. Harmony, however, has not confirmed that amount, and it has not confirmed the claim that 2.8 billion ONE reached exchanges. Its wallet-blocking post also did not identify the exchanges involved or say how much had been frozen.
A rollback would determine whether some state already recognized by the network remains valid. The patch, by contrast, changes how nodes assess future blocks and receipts. The Harmony statements cited in the report say only that rollback options were under review. They do not specify which block, balances, or transfers would be affected.
An earlier supply dispute followed the Horizon bridge loss
Harmony dealt with another supply dispute after its Horizon bridge lost about $99 million in 2022. At that time, the foundation proposed minting either 4.97 billion or 2.48 billion ONE to reimburse affected users, drawing objections tied to dilution.
By the reporting cutoff, Harmony had released the patch, asked exchanges to block four wallets, and paused its bridge. The Harmony statements cited in the report still had not provided a total for the unauthorized mint or the parameters of any rollback.