Hackers Mint 3 Trillion ONE Tokens: Legacy Public Chain Harmony Suffers Another Fatal Blow
- Key Takeaway: The Harmony protocol was hacked due to severe logical vulnerabilities in cross-shard receipt verification and signature checks, resulting in the illegal minting of over 3 trillion ONE tokens (worth approximately $2.34 billion). This caused the token price to plummet nearly 38% within 24 hours, marking another major security incident for the protocol following the 2022 Horizon cross-chain bridge attack.
- Key Elements:
- The attacker exploited two叠加 vulnerabilities: a signature check error (only verifying the number of committee members rather than the actual number of signatures) and a replay protection flaw, allowing forged receipts to be repeatedly used to bypass verification.
- Officials have suspended cross-chain bridge services, requiring validator nodes to upgrade to patch v2026.1.1 to prevent further illegal minting, and have published four sets of involved wallet addresses requesting exchanges to freeze funds.
- Before the incident, Harmony's market cap stood at approximately $17 million; it has since fallen to $12 million, with roughly $5 million in market value erased. TVL has dropped from its 2022 peak of over $1.4 billion to less than $170,000.
- This is Harmony's third token supply-related incident (following the $100 million cross-chain bridge theft in 2022 and the 146 million tokens mistakenly minted due to a staking system bug in 2023), reflecting the fragility of consensus and supply mechanisms in small-cap public chains.
- A network rollback plan has not yet been confirmed. Since a large number of tokens have already flowed into exchanges and been traded, the actual effectiveness of such a rollback may be limited, making the subsequent resolution plan a key short-term market variable.
Original author: Ma He, Foresight News
Hacker attacks are becoming the "number one killer" of crypto protocols.
On August 12, X user Juiceberg posted that on-chain data showed the Harmony protocol had been exploited, with attackers illegally minting approximately 4 billion ONE tokens (worth over $3 million) through empty blocks, accounting for 26% of its total supply. About 2.8 billion of these tokens were rapidly transferred to exchanges during the price crash, while Harmony's total supply endpoint failed to reflect this token inflation, causing a discrepancy between actual on-chain supply and public data. The attacker retained approximately 115 million tokens on-chain (about 2.9% of the minted amount), with the vast majority either already sold, sitting in exchange accounts, or held in deposit wallets.
Following the announcement, ONE's price plummeted from $0.00118 to a low of $0.00056, before recovering to $0.00078, marking a nearly 38% drop in 24 hours.
Harmony's official X account later responded, stating they are working with the team and multiple related exchanges to block and freeze the funds involved. They are also advancing software patch development and evaluating network rollback options.
The team subsequently published four related wallet addresses, explicitly requesting that exchanges block and freeze funds traceable to these addresses:
- one1uap8dx2z0qsjxqthm5flgcxkeepsz3gsrghnfn
- one17u300a40ll5wphd8kj5hktryhdjq3ml9f4phy4
- one1a5hur07z5vtvzhr35zkw8tfqedemkz8t88xgd7
- one1h56hkxmua0uzfv07fu04cudvtrl35u96pq47vy
Around 2 PM, the team officially announced a suspension of the bridge.harmony.one cross-chain bridge service due to the security incident, and required all validator nodes to immediately upgrade to the latest patch version v2026.1.1. The team stated that this patch prevents further illegal minting, with a follow-up update to address the already minted tokens. The relevant release records are already visible on GitHub.
This marks the third major security or technical issue directly related to token supply that Harmony has experienced in recent years. In June 2022, its Horizon cross-chain bridge was attacked, resulting in losses of approximately $100 million in assets, which the FBI later attributed to a North Korean-linked hacking group. In December 2023, a bug in the staking system led to the erroneous minting of approximately 146.3 million ONE tokens across 74 addresses, with one address receiving over 51 million tokens. Some of these tokens were subsequently transferred to exchanges, prompting the team to issue an emergency patch and take follow-up measures.
From a market capitalization perspective, although this incident caused significant supply dilution and severe price volatility, the absolute scale of losses is limited. Before the incident, Harmony's market cap had already fallen to around $17 million; it further declined to approximately $12 million afterward, with roughly $5 million in market cap erased. In 2022, Harmony's total TVL peaked at over $1.4 billion, but according to the latest DefiLlama data, its TVL now stands at less than $170,000.
According to CertiK Alert monitoring, as of around 4 PM, the number of abnormally minted ONE tokens on the Harmony network had exceeded 3 trillion (worth approximately $2.34 billion), involving six anomalous blocks.
In the initial phase, the attacker exploited the total supply endpoint to hide the minting data, and since different blocks were being packaged sequentially, the initial figure of 4 billion minted tokens was far from the true number.
X account BlockWatchdog analyzed the incident, stating that the attacker exploited a severe logical error in Harmony's cross-shard receipt verification and signature checking, forging approximately 3 trillion tokens in one go.
Harmony is a sharded chain, and transferring tokens between shards requires a "receipt" as proof. The hacker forged such receipts, which contained the following:
An epoch from long ago (epoch 100, while the current epoch is already over 3000)
All signatures were empty (zero signatures)
Transfers originating from a dead address (0x00…dEaD)
Under normal circumstances, the system should outright reject these. However, the system had two vulnerabilities: First, the signature check was flawed. When checking whether "enough people signed," the system only looked at "how many people are on the committee," rather than "how many actually signed." As a result, as long as the committee size was ≥4, receipts with all-empty signatures could still pass. It was like a broken door lock that anyone could push open. Second, there was a flaw in the replay protection. The system's check for "has this receipt already been used?" depended on a field from old epochs that the attacker could manipulate. This allowed the attacker to reuse the same fake receipt repeatedly or bypass the check entirely.
With these two vulnerabilities combined, the attacker was able to mint trillions of tokens in a single move.
As of press time, the team has not yet confirmed whether a network rollback will ultimately be executed. A rollback would restore the chain state to a point before the attack, theoretically eliminating some of the impact of the illegal minting. However, with a large number of tokens already transferred to centralized exchanges and traded, the actual effectiveness would be significantly limited. Whether exchanges can effectively freeze the relevant funds, the pace of patch adoption among validator nodes, and the subsequent handling plan for the minted tokens will be the core variables shaping short-term market attention.
As an early Layer 1 public chain focused on high performance and low fees, Harmony once held a notable position in the DeFi and cross-chain narratives. However, consecutive security incidents compounded by prolonged market cap decline have significantly diminished its relevance in the current crypto market.
This incident once again exposes the fragility of small-cap public chains in their consensus and supply mechanisms, and also reminds market participants to more carefully scrutinize the historical security records and actual on-chain activity of similar projects when evaluating them.
