In August 2026, Harmony, the Layer-1 that supports the ONE token, was the victim of an unauthorized minting attack. The attacker created an estimated 4 billion ONE tokens worth an estimated $3.2 million in an empty-block minting exploit.
Inside the Attack
The Harmony One attacker took advantage of a vulnerability in how Harmony handled consensus. This vulnerability allowed them to perform an unauthorized mint that increased the circulating supply of the token by about 26%.
The root cause of the hack was an issue in how the consensus code verified a quorum for a transaction. Instead of checking the number of validators that signed off on a transaction, the protocol counted the number of public keys that were listed within a signature mask.
Since public keys are inherently public, anyone can build a list of public keys for eligible validators on the Harmony blockchain. By only checking the length of the provided list rather than the number of validators that actually signed the transaction, the protocol was essentially checking the length of a list of attacker-provided, publicly accessible data.
The Harmony hacker took advantage of this fact to submit a series of empty blocks that created new tokens without actually passing through consensus. Additionally, the protocol’s totalSupply endpoint, which is the official source for the total circulating supply of tokens, didn’t immediately update its number to include the newly minted tokens.
The minted tokens were distributed across 409 wallets in 10,288 transactions. Due to the delay in updating the totalSupply, the attacker was able to move many of the tokens to exchanges and cash out before the hack was detected.
This incident had a significant impact on the supply and value of the ONE token. The unauthorized tokens increased the total supply by over a quarter and caused the token price to drop by about 40%. The blockchain is planning a rollback to eliminate the excess token supply.
Lessons Learned from the Attack
The Harmony ONE hacker exploited a fundamental bug in how the blockchain handled block approvals. Since most blocks would only submit a list of validators that actually signed the block, the vulnerability flew under the radar until exploited by the attacker.
This incident demonstrates the importance of comprehensive code reviews before code deployment. Halborn’s Code Security Audit services validate both code security and business logic to help avoid costly errors. To learn more about securing your project, get in touch with Halborn.