Author: Ma He, Foresight News
Hack attacks are becoming the "number one killer" of crypto protocols.
On August 12, X user Juiceberg posted on X stating that on-chain data indicated the Harmony protocol had suffered an exploit, where an attacker illicitly minted approximately 4 billion ONE tokens (worth around $3+ million) through empty blocks, accounting for 26% of its total supply. About 2.8 billion of these tokens were rapidly transferred to exchanges during the price plunge. Concurrently, Harmony's total supply endpoint failed to reflect this token issuance, leading to a discrepancy between the actual on-chain supply and publicly available data. The attacker currently holds about 115 million tokens on-chain (approximately 2.9% of the minted amount), with the vast majority already in exchange accounts, either sold or held in deposit wallets.
Following the announcement, the price of ONE plummeted from $0.00118 to a low of $0.00056, currently recovering to $0.00078, marking a nearly 38% decline in 24 hours.
Harmony officials subsequently responded with a repost on X, stating they are collaborating with their team and multiple related exchanges to block and freeze the funds in question; they are also advancing software patch development and evaluating network rollback options.
Later, the officials further disclosed four related wallet addresses, explicitly requesting all exchanges to block and freeze funds traceable to these addresses:
- one1uap8dx2z0qsjxqthm5flgcxkeepsz3gsrghnfn
- one17u300a40ll5wphd8kj5hktryhdjq3ml9f4phy4
- one1a5hur07z5vtvzhr35zkw8tfqedemkz8t88xgd7
- one1h56hkxmua0uzfv07fu04cudvtrl35u96pq47vy
Around 2:00 PM, the officials announced the suspension of the bridge.harmony.one cross-chain bridge service due to the security incident and requested all validator nodes to immediately upgrade to the latest patch version v2026.1.1. The official explanation stated that this patch can prevent further illicit minting, with subsequent updates to be released to handle the already minted tokens. Relevant release records are visible on GitHub.
This marks the third major security or technical issue directly related to token supply for Harmony in recent years. In June 2022, its Horizon cross-chain bridge was attacked, resulting in the loss of approximately $100 million in assets, an event later attributed by the U.S. Federal Bureau of Investigation to a North Korea-linked hacking group. In December 2023, a bug in the staking system led to the erroneous minting of about 146.3 million ONE tokens, involving 74 addresses, with a single address receiving over 51 million; some tokens were subsequently transferred to exchanges. At that time, officials urgently released a patch and took follow-up measures.
In terms of market scale, although this event caused significant supply dilution and drastic price fluctuations, the absolute loss scale is limited. Prior to the incident, Harmony's market capitalization had fallen to around $17 million; post-incident, it further dropped to the $12 million range, evaporating approximately $5 million in market value. In 2022, Harmony's total TVL once peaked at over $1.4 billion. The latest data from DefiLlama shows its TVL is now less than $170,000.
According to CertiK Alert monitoring, as of around 4:00 PM, the number of ONE tokens abnormally minted on the Harmony network has exceeded 3 trillion (worth approximately $2.34 billion), involving six abnormal blocks.
Initially, the attacker exploited the total supply interface to conceal the issuance data, and different blocks were being packed continuously, so the initial reported 4 billion increase was far from the real figure.
The X account BlockWatchdog analyzed the incident, stating that the attacker exploited a severe logic error in Harmony's cross-shard receipt verification and signature checking, fabricating approximately 3 trillion coins in one go.
Harmony is a sharded chain; transferring coins between different shards requires a "receipt" for proof. The hacker forged this receipt, and the receipt stated:
It originated from a very old epoch (epoch 100, currently over 3000)
Signatures were all empty (zero signatures)
It was transferred from a dead address (0x00...dEaD)
Normally, the system should reject it outright. However, the system had two vulnerabilities: First, the signature check was flawed. When the system checked "if enough people signed," it only looked at "how many people are in the committee," not "how many actually signed." Result: As long as the committee had ≥4 members, even all empty signatures would pass. It's like a door lock is broken; anyone can push it open. Second, there was a flaw in the anti-replay protection. The system's check for "has this receipt been used before" relied on a field that the attacker could fill for old epochs. Thus, the attacker could repeatedly use the same fake receipt or bypass the check.
With these two vulnerabilities combined, the attacker was able to mint trillions of coins at once.
As of press time, the officials have not yet confirmed whether a network rollback will ultimately be executed. A rollback would mean restoring the chain state to a point before the attack, theoretically mitigating some effects of the illicit minting. However, once a large number of tokens have entered centralized exchanges and transactions are completed, the actual effectiveness would be significantly limited. Whether exchanges effectively freeze related funds, the adoption progress of the patch among validator nodes, and the subsequent handling plan for the already minted tokens will be the core variables of short-term market focus.
As an early Layer 1 public chain focusing on high performance and low fees, Harmony once held a certain position in the DeFi and cross-chain narratives. Consecutive security incidents coupled with long-term market cap shrinkage have significantly reduced its attention in the current crypto market.
This incident once again exposes the vulnerability of small-cap public chains in consensus and supply mechanisms, reminding market participants to more cautiously examine the historical security records and actual on-chain activity of similar projects during evaluation.
