TheBlock
Harmony plans to roll back its Shard 0 and Shard 1 chains to a snapshot taken just before an exploit that minted roughly 3.01 trillion ONE tokens across six transactions into four attacker wallets. One of those wallets moved nearly 2.4 trillion ONE, worth almost $3 billion at pre-attack prices, in under two minutes before bridges and DEX pools fragmented the trail. An independent researcher first spotted 4 billion tokens minted through empty blocks on Aug. 12; Harmony's reconstruction later revealed that was just the opening wave of a far larger forge.
Why it matters
The rollback is the structural story. Rolling back a top-50 Layer 1 is near-unprecedented in crypto, and Harmony itself framed it as the "fairest and most secure" of the options it studied, which also included a token burn, wallet blacklisting, or a full ONE migration. The flaw lived in cross-shard receipt verification: the network processed valid receipts multiple times, letting the attacker mint new ONE with no corresponding debit elsewhere on the ledger. Harmony patched the vulnerability on Aug. 12, the same day the attack was first confirmed.
Market impact
The 3 trillion forged ONE never legitimately existed on the chain, so the rollback erases phantom supply rather than confiscating real holder balances. That keeps the dilution off the books, but the precedent is the read the rest of the industry will sit with: a live L1 choosing to rewrite history to neutralize a forge rather than absorb it. The investigation has traced nearly all forged tokens to specific wallets and services, though much of the supply already touched DEX pools and bridges, where any targeted burn would have hit innocent users. Expect cross-shard bridge audits to get more expensive as other L1s revisit receipt-verification paths.
Frequently asked questions
-
How did the Harmony ONE exploit work?
The flaw was in cross-shard receipt verification: the network processed valid receipts multiple times, letting the attacker mint new ONE tokens with no corresponding debit elsewhere on the ledger. Harmony patched the bug on Aug. 12.
-
How many ONE tokens were forged in the Harmony exploit?
Harmony's reconstruction found 3.01 trillion ONE were forged across six transactions into four attacker wallets. One wallet moved nearly 2.4 trillion ONE, worth about $3 billion at pre-attack prices, in under two minutes.
-
What is Harmony rolling back on its blockchain?
Harmony plans to roll back Shard 0 and Shard 1 to a snapshot taken just before the forged mint. All blocks and transactions after that point will be discarded on both chains.
-
Why did Harmony choose a rollback over a token burn?
Harmony said a single fixed rollback window is the "fairest and most secure" option. It applies one rule to everyone, removes the forged state, and carries the lowest risk of another attack or consensus failure.
-
Has Harmony traced the forged ONE tokens?
Harmony said it has traced nearly all forged tokens to specific wallets and services, but a meaningful share already passed through DEX pools and bridges, making targeted recovery or burn unsafe for innocent users.
CryptoSlate
CoinTelegraph
CoinDesk
WuBlockchain