Harmony ONE Supply Surges 3.01T via Cross-Shard Exploit

Attackers minted 3.01 trillion ONE tokens by exploiting cross-shard verification flaws. Harmony patched the bug, paused Shard 0, and plans a network rollback to pre-attack state.

Woofun AI reports that Harmony Protocol confirmed an unauthorized secondary offering of ONE tokens occurred on August 12, resulting in the creation of approximately 3.01 trillion tokens. Investigations revealed that attackers exploited a vulnerability in cross-shard receipt re-verification, allowing processed receipts to be executed repeatedly and enabling token generation in empty blocks. Initial analysis indicated a first-round issuance of 4 billion ONE, while latest on-chain reconstruction shows the full 3.

01 trillion distributed to four attacker wallets via six fake transactions. The team has fixed the cross-shard verification and quorum check vulnerabilities, deploying Mainnet v2026.1.1 at 06:30 UTC on August 12. Bridge services are suspended, and Harmony is coordinating with validators, exchanges, and LayerZero to freeze funds, with plans to roll back the network to block 92,730,034. Shard 0 remains paused at block 92,753,555, potentially causing 502 errors for official RPC requests.