Harmony is preparing a full chain rollback to August 11 after an attacker forged ONE tokens by exploiting a cross-shard receipt validation flaw. Validators will revert to the checkpoint at 23:25:37 UTC on August 11, 2026, and rebuild the network using replacement databases. The reset will erase 109,126 regular transactions and 315 staking transactions confirmed after that point.
The first unauthorized tokens appeared in the next block on Shard 0, block number 92,730,036. Harmony said block 92,730,034 on Shard 1 had not been attacked but would be rolled back simultaneously to avoid future inconsistencies. New blocks will begin from heights 92,730,035 and 94,978,279. Harmony’s new client software, v2026.1.2, will refuse to accept block hashes tied to the exploit.
Harmony said selectively restoring transactions was deemed unsafe because balances, contract states, nonces, and other conditions would no longer match on the rebuilt chain. The team considered a targeted burn, a blacklist, selective replay, full token migration, and a built-in revert tool, but rejected each approach: a targeted burn could hurt innocent users because fake tokens had reached exchanges, trading pools, and smart contracts; a blacklist would leave counterfeit supply in the system; selective replay was unworkable; and full migration was too disruptive. An independent security firm reviewed the hack and agreed with the rollback solution.
On-chain expert Juiceberg estimated that the attacker abused how the network checks cross-shard receipts to process the same receipt more than once, creating tokens out of thin air. Harmony said roughly 4 billion ONE, about 26% of the token’s supply, had been created through empty blocks. The attacker attempted 534 payments of 5 billion tokens each in just 106 seconds, and 477 went through, according to the network’s tracking. Investigators have traced nearly all forged tokens to wallets or service boundaries and are coordinating with exchanges, bridges, and law enforcement. At the latest update, ONE traded near $0.0007209, down almost 7%, with a market cap of around $10.8 million.
The rollback follows earlier Harmony incidents, including a December 2023 staking bug that accidentally created 146.28 million ONE tokens and a June 2022 Horizon bridge theft of roughly $100 million that the FBI attributed to North Korea’s Lazarus Group. Harmony’s response also echoes Ravencoin’s recent reorganization attempt after a consensus flaw, reflecting how networks weigh drastic action when ledger integrity is at risk.
