Harmony exploit analysis

On 11 August 2026, an attacker exploited the Harmony blockchain to mint 4 billion of the network's $ONE token. The increase in token supply caused the price of $ONE to fall 40%. Harmony paused its token bridge and asked exchanges to freeze tokens coming from four addresses connected to the attacker. The team said it was considering a possible rollback — reverting the blockchain to a pre-attack state — though they subsequently moved in a different direction, announcing a migration of $ONE to Ethereum and a full shutdown of the Harmony mainnet.

The mechanism was a flaw in Harmony's token-minting logic that allowed an unauthorised account to create new supply. Minting exploits on proof-of-stake chains typically involve either a compromised validator key or a bug in the mint function itself. The public reporting does not specify which. Harmony paused its bridge to limit the attacker's ability to move the newly-minted tokens off the network, and asked centralised exchanges to freeze deposits from the four linked addresses. The rollback decision is contested in the crypto community because chains are usually considered immutable; rolling back a chain has the effect of erasing legitimate activity too. The Harmony team ultimately chose migration to Ethereum rather than rollback, which preserves the chain's history and moves the asset to a different network.

This is the second time Harmony has had mint-related issues. In January 2024, a bug caused around 150 million $ONE to be erroneously minted and distributed to 79 wallets. In June 2022, Harmony suffered a $100 million theft, later attributed by the US FBI to North Korean hacking groups, on the Horizon Bridge. The August 2026 mint exploit fits into a longer history of Harmony struggling with supply-inflation and bridge incidents.

The figures are about price impact rather than realised loss. The 4 billion $ONE tokens were valued at roughly the amount of the resulting 40% price move. The attacker could only realise a profit by selling the minted tokens, which the bridge pause and exchange cooperation made more difficult. No outlet has reported a specific realised dollar figure for the attacker's profit. The relevant numbers are 4 billion $ONE minted, a 40% price decline, and four addresses the Harmony team identified.

The response was operational and directional. Harmony paused its token bridge, asked exchanges to freeze deposits from the attacker addresses, and announced within weeks that it would migrate $ONE to Ethereum and shut down the Harmony mainnet. The migration plan was subsequently elaborated in a series of announcements from the team.

Compared with the other 2026 supply-inflation incidents in the corpus, Harmony's is unusual in that it produced a chain-wide shutdown rather than a patch. The Ravencoin rollback on 11 August also involved rolling back consensus-invalidating blocks, but Ravencoin remained in operation after the rollback. The Harmony team chose the harder path of migration. Within the corpus, the Harmony case is the only August 2026 incident where the affected chain chose to wind down its operations entirely as a response.