Odaily News: Harmony Protocol released an incident update stating that an unauthorized minting of ONE tokens occurred on August 12. The investigation revealed that the attacker exploited a vulnerability in the repeated verification of cross-shard receipts, causing already-processed cross-shard receipts to be executed again and minting ONE in empty blocks. The team is currently verifying two sets of impact data: initial analysis shows 4 billion ONE were minted in the first round, while the latest on-chain reconstruction shows that approximately 3.01 trillion ONE were issued in total to 4 attacker wallets through 6 forged cross-shard transactions. Harmony Protocol confirmed that 4 billion ONE were minted in the first round, generated through two empty block records of 1 billion and 3 billion ONE respectively, of which 2.8 billion ONE were subsequently transferred to other attacker addresses. The team has patched the vulnerabilities in cross-shard receipt verification and pre-staking committee quorum verification, and deployed Mainnet v2026.1.1 at 06:30 UTC on August 12. Bridge services have been suspended, and Harmony Protocol is coordinating with validators, exchanges, and LayerZero to freeze the relevant funds, while preparing to roll back the network to block 92,730,034, the block before the attack occurred. Shard 0 has currently been paused at block 92,753,555, and the official RPC may return 502 errors as a result.
