Harmony Blockchain Hit by Exploit, Billions of Tokens Minted Illegally
Layer-1 blockchain Harmony has confirmed it was the target of an exploit that saw an attacker illegally mint approximately 4 billion ONE tokens. The incident sent the token’s value plummeting by 37%, reaching about $0.00077, according to data from CoinGecko.
On-chain analyst Juiceberg first flagged the unauthorized minting early Wednesday, estimating close to 4 billion tokens – representing about 26% of the total supply – had been created through empty blocks. Around 2.8 billion of these tokens were subsequently funneled onto exchanges as the price declined.
In a follow-up post, the analyst stated that the attacker still held roughly 115 million ONE tokens to sell on-chain, approximately 2.9% of the total minted. “The overwhelming majority (~97%) is already on exchanges,” Juiceberg wrote, indicating the tokens had either been sold or were held in deposit wallets.
Harmony acknowledged the situation in a tweet, stating it was “working with our team and appropriate exchanges to stop and freeze the funds.” The blockchain also indicated it was preparing a patch and considering rollback options. In a subsequent post, Harmony identified four specific wallets, providing them in both Harmony and hex formats, and urged exchanges to block any activity linked to them.
“We are working with our team and appropriate exchanges to stop and freeze the funds. We are working on a patch and rollback options. Will update when we have new information,” Harmony protocol tweeted on August 12, 2026.
Just over two hours after its initial statement, Harmony paused its bridge and released a patch a minute later. The blockchain instructed validators to upgrade to a new build designed to prevent further unauthorized minting, noting that addressing the already created tokens would require another update. This action came five hours after Juiceberg’s initial alert.
The project has yet to disclose the specific vulnerability that enabled the exploit, confirm the exact number of tokens created, or detail how much reached exchanges. An unusual observation noted by Juiceberg was that Harmony’s totalSupply endpoint did not reflect the newly minted tokens, and price trackers continued to list the circulating supply at approximately 14.87 billion.
A rollback would revert the network to its state prior to the exploit, effectively erasing subsequent events from its history. However, this approach carries the risk of invalidating transactions made by legitimate users after the attack.
This is not the first security incident for Harmony. In June 2022, hackers drained approximately $100 million from its Horizon cross-chain bridge, an attack later attributed by the FBI to North Korea’s Lazarus Group.
Harmony’s initial proposal to address the 2022 hack involved reimbursing victims with ONE tokens. This would have necessitated minting billions of new tokens on top of the existing circulating supply and performing a hard fork of the chain. The plan faced significant criticism, leading the team to replace it with a solution funded from its treasury. Now, four years later, an attacker has managed to mint a comparable amount of tokens without authorization.
Harmony’s ONE token now holds a market capitalization of roughly $11.5 million, placing it outside the top 1,000 cryptocurrencies. The token last traded near its October 2021 all-time high of $0.38 more than four years ago and has fallen by over 99% from that peak.
Leave a Reply