Harmony's ONE Token Crashes After Attacker Mints 4 Billion Tokens Through Empty Blocks

Harmony, the layer-1 blockchain that once billed itself as an Ethereum scaling solution, confirmed on August 12 that it had been exploited after an attacker minted roughly 4 billion ONE tokens without authorization — an amount equal to about 26% of the network's entire circulating supply at the time.

The first sign of trouble came from on-chain analyst Juiceberg, who posted on X that Harmony's blockchain had been exploited using empty blocks, and that the network's totalSupply endpoint was not reflecting the new tokens in real time:

Harmony exploited as on-chain data reveals unauthorized 4B ONE mint (26% of supply) via empty blocks, with 2.8B quickly funneled to exchanges as price crashed while totalSupply endpoint hides the inflation $ONE

Empty blocks are ordinary, valid entries on a blockchain that carry no user transactions. According to Juiceberg's findings, the attacker used this mechanism to trigger unauthorized token creation while the chain's public supply counter stayed frozen, buying time before anyone downstream — exchanges, trackers, other validators — noticed anything was wrong. By the time the mint was caught, roughly 2.8 billion of the newly created tokens, about 97% of the total, had already reached exchange wallets, where they had either been sold or were sitting in deposit accounts ready to go. Juiceberg put what was left on-chain at around 115 million ONE, or under 3% of the haul.

Harmony confirmed the exploit hours later on its official account, and asked exchanges directly to freeze funds tied to four wallet addresses connected to the attack:

We are asking all exchanges to block and freeze funds that traces back to these 4 wallet addresses: one1uap8dx2z0qsjxqthm5flgcxkeepsz3gsrghnfn 0xe7427699427821230177dd13f460d6ce43014510 one17u300a40ll5wphd8kj5hktryhdjq3ml9f4phy4 0xf722f7f6afffe8e0dda7b4a97b2c64bb6408efe5

The team said it is working on a software patch and weighing rollback options, though it stopped short of confirming the exact vulnerability or the final size of the mint. A rollback would reset the chain to a point before the exploit and continue from there — which sounds clean in theory, but it would also erase every legitimate transaction users made in the meantime. That's not a decision Harmony can make lightly.

The price reaction was immediate and ugly. ONE dropped anywhere from 26% to 37%, depending on which tracker and time window you check, and was trading around $0.0008. At that price, the entire 4 billion minted tokens works out to roughly $3.2 million on paper. Small next to what a $100 million bridge hack looks like on a spreadsheet, but the number was never really the point. The point is that nobody caught it while it was happening.

This isn't Harmony's first supply scare. In December 2023, a staking bug improperly minted 146.28 million ONE across dozens of delegator addresses after a validator commission change wasn't handled correctly by the network's state machine. Harmony pushed an emergency hard fork, though about 16.4 million tokens had already reached an exchange by then. Further back, in June 2022, attackers compromised the multi-signature wallet on Harmony's Horizon cross-chain bridge and drained close to $100 million. Three supply or bridge incidents in four years is not a coincidence investors will wave off easily.

Harmony isn't the only chain dealing with this kind of headache this week. Ravencoin has been fighting its own rollback question since August 7, after a KAWPOW block-validation flaw let invalid blocks into its ledger and pushed mining pools toward rebuilding the chain from the first bad block. In June, Humanity Protocol lost about $36 million when compromised admin keys were used to mint 300 million unauthorized H tokens across two networks, and that token fell almost 90%. Unauthorized minting keeps showing up as the failure mode, on chains with very little else in common.

For now, ONE holders are watching two things: whether Harmony can get exchanges to freeze the tokens still sitting in deposit wallets before they're sold, and whether a rollback is even on the table without alienating the users whose transactions would be wiped out. Neither answer looks straightforward.