Harmony Will Roll Back Its Blockchain to Erase 3 Trillion Forged Tokens

Harmony plans a rollback to a pre-exploit 11 August checkpoint

Harmony plans to restart its network from a state recorded before last week's exploit. Validators would revert to blocks logged at 11:25 pm UTC on 11 August 2026, keeping shard 0 block 92,730,034 and shard 1 block 94,978,278. The layer-1 blockchain runs on a sharded design, meaning two parallel chains process transactions together. Both would restart from replacement databases built around those checkpoints. Harmony described the fixed rollback window as a plan, not a completed action, and said validators must upgrade before the network can resume.

The rollback discards more than 109,000 confirmed transactions

The reset carries a cost for recent users. Harmony said the rollback would discard 109,126 regular transactions and 315 staking transactions confirmed after the checkpoint. Every block and transfer recorded after 11:25 pm UTC on 11 August would be erased. Anyone who traded, staked, or moved ONE in that window would lose those on-chain records once the network restarts. Harmony said it studied alternatives, including a token burn, blacklisting affected wallets, and a full ONE token migration, before selecting the rollback.

Attackers forged trillions of ONE across six transactions

The scale of the exploit grew as investigators dug deeper. An independent researcher first identified 4 billion ONE minted through empty blocks. Harmony later found that figure was only the first wave. A reconstruction counted about 3.01 trillion ONE forged across six transactions into four attacker wallets, according to reporting on Harmony's incident update. One wallet moved nearly 2.4 trillion ONE in under two minutes, worth close to $3 billion at pre-attack prices. Harmony said it traced nearly all the forged tokens, though many passed through decentralised exchange (DEX) pools and bridges.

A cross-shard flaw let receipts be reused to mint tokens

Harmony said the exploit stemmed from a flaw in its cross-shard receipt verification. The bug let valid receipts be processed more than once, so the attacker minted new ONE without any matching debit elsewhere. Harmony confirmed the exploit on 12 August and patched the vulnerability the same day. Developers also adjusted the network's quorum checks to reduce the risk of a repeat. Harmony said much of the forged supply cannot be safely burned, because those tokens now sit alongside funds held by innocent users.

ONE has lost about 42% over the past week

ONE traded at about $0.00072 at the time of publication, down roughly 42% over the past seven days (CoinPaprika, 18 August 2026). The token's market value stood near $10.3 million, far below its past peak. The 24-hour move was smaller, down about 2% (CoinPaprika, 18 August 2026). Trading volume over the same day reached about $1.8 million as holders reacted to the rollback plan.

Harmony weighed a token burn before choosing the rollback

Harmony framed the rollback as the least risky path among imperfect options. It said selectively restoring transactions was unsafe because balances, contract states, and nonces would differ after the reset.

"Of the options we studied, one fixed rollback window is the fairest and most secure. It applies one rule to everyone, removes the forged state, and carries the lowest risk of another attack or consensus failure.", 17 August 2026. — Harmony, incident update

Harmony said work continues with exchanges, bridges, and law enforcement to trace the forged tokens.