Harmony Protocol Confirms Unauthorized ONE Minting and Suspends Bridge Services

Harmony Protocol said an unauthorized ONE minting incident occurred on August 12. According to Odaily, the attack used a cross-shard receipt replay vulnerability, allowing processed cross-shard receipts to be executed again and ONE to be minted in empty blocks.The team is verifying two sets of impact data. Early analysis showed an initial minting of 4000000000 ONE, while the latest on-chain reconstruction showed that about 3010000000000 ONE was issued to four attacker wallets through six forged cross-shard transactions. Harmony Protocol confirmed the first round of minting involved 1000000000 ONE and 3000000000 ONE from two empty-block entries, and 2800000000 ONE was later transferred to other attacker addresses.The team said it has fixed the cross-shard receipt verification issue and the quorum verification bug for the pre-staking committee, and deployed Mainnet v2026.1.1 at 06:30 (UTC+8) on August 12. Bridge services have been suspended, and Harmony Protocol is working with validators, exchanges, and LayerZero to freeze the related funds. It is also preparing to roll back the network to block 92,730,034 before the attack. Shard 0 has been halted at block 92,753,555, and the official RPC may return 502 errors as a result.