Harmony Exploit Mints 4 Billion ONE and Crashes the Token 35%

An attacker minted about 4 billion ONE tokens, roughly 26% of the Harmony blockchain's token supply, and had nearly all of it positioned on exchanges before the team's first public response on Aug. 12.

The scale is brutal on both ends: enough new supply to dilute every holder by a quarter, yet worth only about $3.2 million at ONE's crashed price.

The token fell as low as $0.000437 on KuCoin before settling around $0.0008, down about 35% in 24 hours and almost 99.8% below its October 2021 all-time high of $0.379.

Empty Blocks and a Masked Supply

On-chain analyst Juiceberg, who first flagged the exploit, said the tokens were minted through empty blocks while Harmony's totalSupply endpoint continued to hide the inflation.

By his accounting, about 2.8 billion ONE was funneled to exchanges quickly, and only around 115 million, under 3% of the minted haul, remained to sell on-chain; the rest had been sold or sat in deposit wallets ready to go.

Harmony confirmed the exploit, asked exchanges to freeze funds tracing to four wallet addresses it published, paused its cross-chain bridge, and shipped a validator patch it says prevents further minting.

We are working with our team and appropriate exchanges to stop and freeze the funds. — Harmony team on X.

It has not disclosed the root cause, and says it is evaluating rollback options, a step that would rewrite chain history and that layer-1 networks rarely take.

The 33% drawdown barely registers as significant on the token's 1-year chart.

ZachXBT Refuses to Help This Time

The sharpest reaction came from the space's best-known investigator, who publicly declined to trace the funds.

I will not be tracking this incident and think no one should assist them for free. Harmony took advantage of people who assisted during the $100M Harmony Bridge exploit by DPRK in 2022 and rewarded $0 for significant freezes which lead to LE seizures and simply said "good job"

ZachXBT posted that on Aug. 12, referring to the June 2022 Horizon bridge theft of nearly $100 million, which the FBI attributed to North Korea's Lazarus Group and APT38. This mint is Harmony's second existential security failure in four years, and this time the volunteer talent is sitting out.

Harmony says a further update will address the already-minted tokens. The decision to watch is the rollback: whether the chain erases the mint or lives with a supply a quarter larger than its holders signed up for.