Harmony Protocol confirms the first round of issuance of 4 billion ONE and prepares to roll back

Harmony Protocol released an event update stating that an unauthorized ONE minting incident occurred. Investigations show that the attacker exploited a cross-shard receipt replay vulnerability, allowing processed cross-shard receipts to be executed multiple times, and minted ONE in empty blocks.

The team is currently verifying two sets of impact data: early analysis indicates that the first round of minting involved 4 billion ONE, while the latest on-chain reconstruction shows that approximately 3.01 trillion ONE were issued to four attacker wallets through six forged cross-shard transactions. Harmony Protocol confirmed the first round of minting of 4 billion ONE, generated through two empty block accounting transactions that produced 1 billion and 3 billion ONE respectively, of which 2.8 billion ONE were subsequently transferred to other attacker addresses.

The team has fixed the cross-shard receipt verification and pre-staking committee quorum verification vulnerabilities and deployed Mainnet v2026.1.1. Bridge services have been suspended, and Harmony Protocol is coordinating with validators, trading platforms, and LayerZero to freeze related funds, preparing to roll back the network to block 92,730,034 before the attack occurred. Currently, Shard 0 has been paused at block 92,753,555, and the official RPC may return a 502 error as a result.