Harmony Protocol has confirmed an unauthorized minting of its ONE token after an attacker exploited a cross-shard receipt replay vulnerability. The flaw let already-processed cross-shard receipts be executed again, minting ONE inside empty blocks. Early analysis pointed to an initial 4 billion ONE minted, while a fresh on-chain reconstruction shows about 3.01 trillion ONE issued via six forged cross-shard transactions to four attacker wallets. Harmony also confirmed the initial mint came in two empty-block batches of 1 billion and 3 billion, with 2.8 billion subsequently moved to other attacker addresses. The project has patched the receipt validation and pre-staking committee quorum verification issues, and deployed Mainnet v2026.1.1. Bridge services are paused while it coordinates with validators, exchanges and LayerZero to freeze funds. The network is being rolled back to block 92,730,034; Shard 0 is halted at block 92,753,555, which may cause the official RPC to return 502 errors.
Harmony Protocol has confirmed an unauthorized minting of ONE tokens after an attacker exploited a cross-shard receipt replay vulnerability. The bug allowed already-processed cross-shard receipts to be replayed inside empty blocks, creating new ONE.
Two impact estimates
The team is verifying two sets of numbers. Early analysis pointed to an initial 4 billion ONE minted. A fresh on-chain reconstruction shows roughly 3.01 trillion ONE issued through six forged cross-shard transactions to four attacker-controlled wallets.
Harmony confirmed the initial 4 billion ONE came from two empty-block batches of 1 billion and 3 billion each. Of that, 2.8 billion ONE was later moved to other attacker addresses.
Fix and recovery
The project says it has patched the cross-shard receipt validation flaw and the pre-staking committee quorum verification issue, then deployed Mainnet v2026.1.1. Bridge services have been paused while Harmony coordinates with validators, exchanges and LayerZero to freeze related funds. The network is being prepared for a rollback to block 92,730,034, before the attack occurred. Shard 0 has paused at block 92,753,555, and the official RPC may return 502 errors as a result.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
