Harmony released an emergency mainnet patch on Aug. 12 to block further unauthorized minting of its native ONE token. The v2026.1.1 update addresses two critical flaws in its cross-shard receipt verification system.
On-chain researcher Juiceberg estimated approximately 4 billion ONE tokens were minted without authorization — roughly 26 percent of Harmony's total token supply. Harmony's official notice confirmed the minting occurred but did not disclose the specific amount.
Of the estimated unauthorized tokens, Juiceberg's analysis showed 2.8 billion ONE had reached various exchanges. Harmony asked exchanges to block and freeze traceable funds from four implicated wallet addresses, though it did not name the venues or specify frozen amounts.
The patch addresses a flaw where an empty signer record and a mathematically neutral aggregate signature could pass a quorum check. The network's verifier incorrectly counted the full committee rather than only the validators represented in the signer record, allowing receipts to be accepted without approvals.
A second vulnerability involved how the network recorded spent receipts. Certain proof fields were not bound to the signed block header, allowing previously processed receipts to appear new if those fields were altered — crediting a destination multiple times without a corresponding debit from the source.
The v2026.1.1 release changes the quorum calculation logic and ties the spent marker to authenticated header data, closing both identified paths for unauthorized token creation and replay attacks.
Harmony's response included pausing its bridge.harmony.one service. The project's notice did not identify the bridge itself as the exploited component, differentiating this incident from prior ones.
This incident is technically distinct from the June 2022 Horizon bridge exploit, which resulted in about $100 million in stolen assets due to compromised multisig control. The current exploit targeted receipt verification and replay at the core protocol level.
Harmony's initial statements said network rollback options were under consideration. The project has not announced a rollback decision or specified a point from which transactions could be reversed.
ONE's price dropped 37.69 percent over the 24 hours following the news. The token ranked No. 841 by market capitalization at the time of publication.
The 4 billion ONE already created and its distribution remain the core risk. How much exchanges can freeze and whether Harmony pursues a rollback are unresolved. Harmony said it will address the minted tokens in a subsequent update, with details pending.
