Harmony, the sharded layer-1 whose native token is ONE, said on August 13, 2026 that it is working on a rollback and lining up validators and exchanges on the specific path, a day after it confirmed unauthorized minting and asked venues to freeze four wallets.
What the project has put on the record
Harmony’s first public note, posted early August 12, was short: the team was working with exchanges to stop and freeze funds, and it was preparing a patch plus rollback options.
A second post named four wallet pairs (Harmony one1… addresses and their 0x counterparts) and asked every exchange to block funds that trace back to them:
one1uap8dx2z0qsjxqthm5flgcxkeepsz3gsrghnfn/0xe7427699427821230177dd13f460d6ce43014510one17u300a40ll5wphd8kj5hktryhdjq3ml9f4phy4/0xf722f7f6afffe8e0dda7b4a97b2c64bb6408efe5one1a5hur07z5vtvzhr35zkw8tfqedemkz8t88xgd7/0xed2fc1bfc2a316c15c71a0ace3ad20cb73bb08ebone1h56hkxmua0uzfv07fu04cudvtrl35u96pq47vy/0xbd357b1b7cebf824b1fe4f1f5c71ac58ff1a70ba
The project then paused bridge.harmony.one and told validators to install emergency release v2026.1.1, saying the patch “prevents any further minting” and that already-minted tokens would be handled in a later update.
By mid-morning UTC on August 12, Harmony said it had traced 10,288 transfers across 409 wallets that received the fraudulently minted tokens, alerted exchange partners on hundreds of suspicious deposits, and that those partners had blocked the attacker’s wallets. It also said 53% of validators had installed the patch within four hours of release, and that a rollback looked like “the most favored practical solution so far.”
The August 13 follow-up is the new fact for this desk: the mint-bug fix is “activated,” a full exploiter-wallet list is still coming, and the team is “working on a rollback approach, with alignment from validators and exchanges.” Harmony publicly pinged Binance, Gate, HTX (Huobi), and KuCoin. It has not published a rollback height, a cutover time, or how much ONE those venues actually froze.
The 4 billion figure is an estimate
On-chain commentator Juiceberg reported an unauthorized mint of about 4 billion ONE, roughly 26% of the supply figure used in that post, with about 2.8 billion moved toward exchanges. A follow-up put roughly 115 million ONE still sitting in mint-side addresses and said about 97% of the estimated mint had already reached exchange deposit hops.
CoinDesk, CryptoSlate, and Bitcoin.com News carried those numbers. CryptoSlate is explicit that Harmony has not independently confirmed the 4 billion or 2.8 billion totals. Treat them as a widely repeated researcher claim, not a project disclosure. Harmony has confirmed that fraudulent minting happened, that minted tokens landed in hundreds of wallets, and that further minting is what the patch is meant to stop.
ONE sold off hard as the reports hit. CoinDesk described a drop on the order of 40%; Bitcoin.com News said more than 30% to an all-time low. That is the tape reacting to a supply shock and a possible rewrite of recent history, not a separate markets call.
What the patch says broke
CryptoSlate’s read of pull request #5101 (the only change listed in the v2026.1.1 notes) is the clearest public technical account so far. Harmony shards the chain. Cross-shard receipts carry a transaction’s result from one shard to another. The patch targets two receipt checks.
The first let an empty signer record and a mathematically neutral aggregate signature pass a quorum test, because the verifier counted the full committee instead of the validators actually represented in the signer set. The second left some “already spent” proof fields unbound to the signed block header, so a previously processed receipt could be tweaked to look new and get credited again. The release changes the quorum math and ties the spent marker to authenticated header data.
Juiceberg described the mint as happening “via empty blocks.” Harmony has not published its own root-cause write-up. Until it does, the GitHub diff plus the project’s “further minting is blocked” claim is the official technical record.
This is a different failure than Harmony’s June 2022 Horizon bridge theft of about $100 million, which investigators tied to compromised multisig keys rather than a receipt-verification bug. Same chain, different layer.
A rollback is social, not cryptographic
A chain rollback means validators agree to treat some already-published history as if it did not happen, then resume from an earlier block. Honest transfers, DEX trades, and bridge messages that landed after that height can disappear or need to be replayed. Coins already sold on an exchange are someone else’s problem unless the venue freezes and claws back the deposit. Coins still sitting in a self-custodied wallet on the bad history can vanish from that wallet if the new history never credits them.
That is why Harmony is talking to both validators and exchanges. The patch stops new inflation. The rollback, if it happens, is an attempt to unwind the inflation that already exists. Neither step is automatic, and neither is final until a supermajority actually runs the same software and venues honor the same address list.
On-chain investigator ZachXBT said he will not track the incident and argued that Harmony paid nothing to people who helped freeze funds after the 2022 Horizon hack. That is his account of 2022, not a finding in this case. It does mean one of the industry’s most-watched tracers is sitting this one out.
If you hold ONE on a global venue Harmony named (Binance, Gate, KuCoin, HTX), a deposit freeze can hit you before any rollback height is published. If you hold ONE in a wallet you control, you still live with the chain’s social consensus: a successful rollback rewrites balances; a failed or partial one leaves extra supply in circulation.
Takeaway
On August 12 Harmony confirmed unauthorized ONE minting, published four wallets, paused its official bridge, and shipped validator patch v2026.1.1. On August 13 it said the mint-bug fix is active and that it is working on a rollback with validator and exchange alignment. The widely cited ~4 billion ONE / ~2.8 billion to exchanges totals come from Juiceberg, not from a Harmony confirmation.
Watch three things next: whether Harmony names a rollback height, what share of validators actually run the new binary, and how much of the traced deposit flow the named venues keep frozen. Holding your own keys does not cap a chain’s supply and does not veto a rollback. This is a live incident report, not investment advice.
