Harmony ONE Exploit: 4 Billion ONE Confirmed as Review Points to 3.01 Trillion

On August 12, 2026, the Harmony ONE exploit allowed unauthorized creation of the network's native token through flaws in cross-shard receipt validation. Harmony has confirmed an initial mint of 4 billion ONE, while its latest reconstruction indicates that six forged cross-shard transactions may have issued roughly 3.01 trillion ONE in total. The project is still reconciling those figures, which means the 3.01 trillion estimate should not yet be treated as a final settled total.

ONE fell about 40% as news of the exploit reached the market. On-chain researcher Juiceberg initially reported that roughly 2.8 billion ONE from the first detected mint had moved toward exchanges and also found that Harmony's totalSupply endpoint did not immediately reflect the unauthorized tokens. Harmony has since confirmed the exploit and its technical cause, although the supply-endpoint discrepancy remains an investigator-reported finding rather than a detail independently documented in Harmony's incident report.

• Harmony suffered an unauthorized ONE minting exploit on August 12, 2026.

• The project has confirmed an initial 4 billion ONE mint, while a later reconstruction points to approximately 3.01 trillion ONE created through six forged cross-shard transactions.

• Harmony's code changes show weaknesses in cross-shard receipt replay protection and quorum verification.

• Emergency release v2026.1.1 was deployed to prevent further exploitation, while bridge services were suspended.

• Harmony is preparing a rollback to block 92,730,034, before the exploit occurred.

At a technical level, the exploit targeted the way Harmony processes cross-shard receipts, which are used to communicate transaction results between different parts of the network. Harmony's published code changes show two relevant weaknesses. One could allow a quorum check to succeed without the required validator approvals, while another could make a previously processed receipt appear unused, allowing the destination to be credited again without another corresponding debit.

The numbers require more caution than the first reports suggested. Harmony says the first confirmed activity consisted of two empty-block transactions that created 1 billion and 3 billion ONE, respectively. Its subsequent reconstruction, however, identified six forged cross-shard transactions involving four attacker wallets and put the potential total issuance at roughly 3.01 trillion ONE. Harmony is still verifying the difference between the initial 4 billion figure and the much larger reconstruction.

This also means the widely reported claim that the exploit increased ONE supply by about 26% applies only to the original 4 billion estimate compared with the roughly 15 billion ONE reported before the attack. It should not be used to describe the possible 3.01 trillion figure now under investigation.

One of the most unusual details came from Juiceberg's initial investigation. The researcher reported that Harmony's totalSupply endpoint did not immediately include the newly created ONE, even while unauthorized tokens were already moving through the network and toward exchanges. Public price trackers were consequently still displaying supply figures that did not account for the reported mint.

That matters because token supply is a basic input for assessing dilution, market capitalization and the scarcity of an asset. Any service relying on stale supply data without independently reconciling the underlying chain could underestimate the scale of a sudden minting event. It would be too broad, however, to say that every wallet, exchange or data platform depended exclusively on Harmony's totalSupply endpoint.

For traders and data providers, incorrect or delayed supply data can distort several basic metrics:

• Circulating supply, because newly created tokens may not appear in the reported figure

• Market capitalization, which depends on both token price and the number of tokens in circulation

• Dilution estimates, making it harder to judge how much existing holdings have been devalued

• Risk monitoring, because an abnormal increase in supply would normally be one of the clearest signs of unauthorized minting

The distinction is important. The exploit itself created the economic risk, while the reported supply discrepancy potentially made that risk harder to identify through standard monitoring tools. The problem was therefore not simply that ONE's price fell, but that the amount of ONE believed to exist became uncertain while the incident was unfolding.

You can find more stories like this on our crypto news page.

Harmony released Mainnet version v2026.1.1 at 06:30 UTC on August 12. The update incorporated fixes to the cross-shard receipt logic, including the quorum calculation and the mechanism used to determine whether a receipt had already been processed. Harmony also suspended its bridge services and began coordinating with exchanges and other infrastructure providers over funds connected to the exploit.

The project is now preparing to roll the network back to block 92,730,034, which predates the unauthorized minting. Shard 0 was subsequently paused at block 92,753,555 while Harmony coordinated the rollback with validators and exchanges.

A rollback could remove fraudulent state changes from the canonical chain, but it also creates a separate problem. Transactions completed legitimately after the selected rollback point can be affected as well, which is why coordination between validators, exchanges and infrastructure providers matters before the network resumes normal operation.

The August 2026 incident follows two earlier problems involving Harmony. In June 2022, attackers stole about $100 million from the Horizon Bridge after compromising its security. The FBI later attributed the theft to North Korea's Lazarus Group.

Harmony then experienced a separate token-creation issue in December 2023. A staking bug resulted in approximately 146.3 million ONE being improperly created, with part of that amount later moving to an exchange.

The 2026 exploit is technically different from both cases. The 2022 attack involved the bridge, while the current incident concerns receipt validation and replay logic inside the Harmony protocol itself. For traders, that history is relevant because it introduces network and operational risks that cannot be measured through price charts alone.

This was not a conventional market move caused only by changing demand. The underlying supply of the asset was altered without authorization, and the scale of that change was uncertain while the market was already repricing ONE. A stop order can reduce exposure to price movements when liquidity and execution are available, but it cannot prevent dilution or eliminate protocol-level risk.

That distinction matters particularly with smaller-cap assets. Technical indicators can tell you how price is behaving, but they cannot tell you whether a chain's token accounting, validator software or cross-shard logic is functioning correctly. Protocol risk therefore needs to be considered separately from the trading setup itself.

The Harmony incident also shows why checking one supply figure is not always enough. When a security incident is active, traders need to consider the status of the network, exchange deposits and withdrawals, bridge operations and independent on-chain data alongside the quoted market price.

Know your liquidation price and your drawdown buffer before you enter any position in a volatile low-cap asset. The market can take your money quickly. A broken protocol can do it while telling you everything is fine.