Category: Uncategorized

Harmony Blockchain Hit by Exploit, Billions of Tokens Minted Illegally

Layer-1 blockchain Harmony has confirmed it was the target of an exploit that saw an attacker illegally mint approximately 4 billion ONE tokens. The incident sent the token’s value plummeting by 37%, reaching about $0.00077, according to data from CoinGecko.

On-chain analyst Juiceberg first flagged the unauthorized minting early Wednesday, estimating close to 4 billion tokens – representing about 26% of the total supply – had been created through empty blocks. Around 2.8 billion of these tokens were subsequently funneled onto exchanges as the price declined.

In a follow-up post, the analyst stated that the attacker still held roughly 115 million ONE tokens to sell on-chain, approximately 2.9% of the total minted. “The overwhelming majority (~97%) is already on exchanges,” Juiceberg wrote, indicating the tokens had either been sold or were held in deposit wallets.

Harmony acknowledged the situation in a tweet, stating it was “working with our team and appropriate exchanges to stop and freeze the funds.” The blockchain also indicated it was preparing a patch and considering rollback options. In a subsequent post, Harmony identified four specific wallets, providing them in both Harmony and hex formats, and urged exchanges to block any activity linked to them.

“We are working with our team and appropriate exchanges to stop and freeze the funds. We are working on a patch and rollback options. Will update when we have new information,” Harmony protocol tweeted on August 12, 2026.

Just over two hours after its initial statement, Harmony paused its bridge and released a patch a minute later. The blockchain instructed validators to upgrade to a new build designed to prevent further unauthorized minting, noting that addressing the already created tokens would require another update. This action came five hours after Juiceberg’s initial alert.

The project has yet to disclose the specific vulnerability that enabled the exploit, confirm the exact number of tokens created, or detail how much reached exchanges. An unusual observation noted by Juiceberg was that Harmony’s totalSupply endpoint did not reflect the newly minted tokens, and price trackers continued to list the circulating supply at approximately 14.87 billion.

A rollback would revert the network to its state prior to the exploit, effectively erasing subsequent events from its history. However, this approach carries the risk of invalidating transactions made by legitimate users after the attack.

This is not the first security incident for Harmony. In June 2022, hackers drained approximately $100 million from its Horizon cross-chain bridge, an attack later attributed by the FBI to North Korea’s Lazarus Group.

Harmony’s initial proposal to address the 2022 hack involved reimbursing victims with ONE tokens. This would have necessitated minting billions of new tokens on top of the existing circulating supply and performing a hard fork of the chain. The plan faced significant criticism, leading the team to replace it with a solution funded from its treasury. Now, four years later, an attacker has managed to mint a comparable amount of tokens without authorization.

Harmony’s ONE token now holds a market capitalization of roughly $11.5 million, placing it outside the top 1,000 cryptocurrencies. The token last traded near its October 2021 all-time high of $0.38 more than four years ago and has fallen by over 99% from that peak.

Harmony Blockchain Hit by Exploit, Billions of ONE Tokens Minted

The Layer 1 blockchain Harmony has been targeted by an attacker who minted at least 4 billion of its native ONE token, causing the cryptocurrency to plummet to a new all-time low.

Data from CoinGecko indicates that the ONE token fell to $0.0005735 following the incident.

On August 12, X user Juiceberg was among the first to report the exploit, stating that an unidentified individual had minted 4 billion ONE tokens, representing approximately 26% of the total supply. The attacker then moved about 2.8 billion of these tokens to exchanges.

“The attacker has roughly 115M ONE left to sell onchain — about 2.9% of the ~4B they minted,” the on-chain analyst wrote. “Approximately 97% is already on exchanges and has either been sold or is sitting in deposit wallets ready to sell.”

The Harmony protocol later acknowledged the incident but did not immediately disclose the root cause or confirm the exact number of tokens minted by the hacker. The team stated they were collaborating with several exchanges to freeze the illicitly minted funds and were developing a patch to address the vulnerability, along with rollback options. They pledged to provide further updates as new information became available.

Harmony has identified four wallet addresses associated with the theft: one1uap…43014510, one17u300a…6408efe5, one1a5hur07z…73bb08eb, and one1h56hkx…58ff1a70ba. The protocol has requested all exchanges to block and freeze any funds traceable to these addresses. In response to the exploit, the team has also paused the LayerZero-Harmony bridge and instructed validators to apply a patch to prevent further unauthorized minting of ONE tokens.

“We’ll follow up with another update to address already minted tokens,” the team stated.

This is not the first security breach for Harmony. In 2022, the protocol lost approximately $100 million when its Horizon Bridge was exploited.

Prior to the latest incident, the ONE token was trading around $0.00117. It experienced a sharp decline to approximately $0.00057, marking a new all-time low. At the time of reporting, the token had recovered slightly, trading 33% above its all-time low, but still represented a nearly 40% loss within a 24-hour period. Over the past seven days, the asset has fallen 32%, and its monthly chart shows a decline of over 28%, according to CoinGecko data.

The Harmony exploit occurred shortly after a separate incident that targeted the XRPL-Coreum bridge, resulting in the theft of nearly 200,000 XRP. In that attack, the hacker reportedly manipulated the bridge’s deposit-checking system to misinterpret a wallet-to-wallet transfer as a legitimate deposit.

Bridge Exploited, Nearly 200,000 XRP Stolen Through Fake Deposit Scheme

A bridge connecting the XRP Ledger and Coreum, now rebranded as tx, was exploited on August 9, resulting in the loss of nearly 200,000 XRP. An attacker successfully tricked the system into recognizing a wallet-to-wallet transfer as a legitimate deposit, leading to the theft.

The bridge has since been halted. Investigations by the operator and external researchers indicate the failure originated in Coreum-side software, with no issues identified on the XRP Ledger itself.

Initial Warnings and Exploitation Details

The first public alert came from a trader known as playa, who observed that the bridge’s XRP Ledger account was rapidly losing funds. Playa initially pointed to the account’s DefaultRipple setting as the potential cause. According to playa’s observations, the balance dropped from 93,700 XRP to 77,200 XRP within minutes, part of a larger, ninety-seven-minute drain.

Another user, Vet, clarified in the same discussion thread that the Coreum bridge was actively being exploited. Playa later acknowledged a rushed initial assessment.

The tx team confirmed the exploit, stating that its software “incorrectly registered transactions that never actually delivered any XRP to the bridge.”

Technical Breakdown of the Attack

Reza Bashash provided a technical explanation of the attack mechanism. The attacker sent the bridge’s own wrapped token between two of their wallets, appending a bridge-deposit memo. Because the token was issued by the bridge, the transfer appeared in the bridge’s transaction history and was mistakenly treated as a genuine deposit.

Relayers then approved these transactions, leading to the minting of unbacked assets on the Coreum side. The attacker subsequently withdrew real XRP against these fabricated assets. Bashash estimated the total stolen XRP at 198,715.88, which was then converted to ETH, routed through THORChain, and ultimately sent to Tornado Cash.

Remediation and Market Impact

The tx team has identified the vulnerability, and the bridge remains offline. A report has been filed with the FBI’s Internet Crime Complaint Center. No other bridged assets were affected by the incident. The operator is currently developing a plan to compensate affected users.

A subsequent on-chain review revealed the same root cause from a different perspective: 21 separate Coreum relayers independently attested to the same fraudulent deposit. This allowed the attacker to mint unbacked bridge assets and repeatedly execute the scheme with increasing amounts before cashing out. Each payout on the XRP Ledger was validated by a multisignature from the bridge’s relayer quorum, explaining why the initial DefaultRipple theory proved insufficient once transaction data was scrutinized. Native XRP does not utilize trust lines in this manner, and the DefaultRipple flag is specific to the bridge’s issued tokens.

The exploit occurred as XRP’s price was already declining. The token was trading around $1.02, near a 21-month low, and had fallen approximately 4.4% for the week. This downturn coincided with Bitcoin’s drop to around $64,000 and a broader crypto market decline of roughly $40 billion in a single day.