Harmony confirmed on 12 August that an attacker had minted roughly 4 billion ONE tokens without authorisation, expanding a supply of about 15 billion by around a quarter. ONE fell to an all-time low of $0.0005735 the same day, a drop reported between 26% and 40% depending on the window measured.
The root cause is unusually clean. Harmony’s consensus code verified quorum by counting the public keys listed in a signature mask rather than the validators that had actually signed. A message carrying no valid signatures at all therefore satisfied the quorum threshold, and the attacker used empty blocks to mint against it. The check was counting claims rather than proofs.
What turned a bug into a loss was the reporting layer. Harmony’s totalSupply endpoint masked the new tokens, so the inflation was not visible where anyone monitoring the chain would have looked for it. By the time the exploit was recognised, roughly 97% of the fraudulent supply had reached exchanges, with about 2.8 billion ONE funnelled out as the price fell. The window between exploit and detection is where the money went.
Harmony paused its Horizon bridge, shipped a validator patch as v2026.1.1 to stop further minting, identified four wallet addresses tied to the incident and is working with exchanges to freeze the proceeds. It is also evaluating a network rollback, which is the decision that actually matters: reversing the chain claws back tokens already sold to people who bought them in good faith, and declining to means the inflation is permanent. There is no version of that choice where the holders of ONE are made whole.
