- An attacker minted roughly 4 billion unauthorized ONE tokens through an empty-block exploit on Harmony’s network.
- The token fell as much as 40% intraday, touching an all-time low near $0.00057 before recovering slightly.
- Harmony has paused its bridges, patched the minting bug, and is weighing a hard rollback of the chain.
- Roughly 70% of the minted supply already moved onto e xchanges before the team could react.
Harmony’s ONE token dropped between 26% and 40% on August 12 after an attacker discovered a way to mint approximately 4 billion tokens out of thin air, an amount equal to roughly a quarter of the network’s circulating supply. The exploit pushed the price to an all-time low of $0.00057 before it clawed back to the $0.0007-$0.0008 range, according to data from multiple outlets tracking the incident.
The figures vary by measurement window: Harmony’s own statement references the 26% supply dilution, while the wider 33-40% range reflects the token’s price swing over the following hours as the new supply hit exchanges.
How an Empty Block Bypassed Harmony’s Own Checks
On-chain researcher Juiceberg identified the attack on X: the attacker minted tokens through empty blocks, a method that sidesteps the transfer alerts and smart contract calls that typically flag unusual token movements. Harmony’s public totalSupply API endpoint did not immediately reflect the new supply, which meant data aggregators and traders had no early warning that the token had just been diluted by roughly 26%.
That gap between what happened on-chain and what the network’s own tools reported gave the attacker a window to move funds before the market could price in the damage. Roughly 2.8 billion of the minted tokens, close to 70% of the total, landed on centralized exchanges, where they could be sold directly into order books. Only about 115 million tokens, under 3% of the exploit, remained sitting in the attacker’s wallets by the time the incident became public.
Daily Candle Breaks Below the 50-Day Average
The daily ONE/USDT chart on Binance shows the exploit’s effect in stark terms. The token opened the session at $0.00117 and closed at $0.00079, a single-candle loss of 33.05%, with the day’s low reaching $0.00056. That candle sits well below the 50-day simple moving average of $0.00121, a level the price had already been struggling under for weeks.
The RSI, a momentum gauge that ranges from 0 to 100, dropped to 24.50 on the daily timeframe. Readings below 30 typically signal that an asset has been sold off faster than its recent trading history would suggest is sustainable, though that alone says nothing about whether a bounce is imminent. The RSI’s own moving average sits at 46.94, underscoring how sharply momentum turned in a single session rather than eroding gradually.
Harmony Freezes Attacker Wallets and Weighs a Hard Rollback
The Harmony team confirmed the exploit through a post on X and named four wallet addresses tied to the attack. It is now working with exchanges to freeze any accounts linked to those wallets. Validators have been instructed to deploy a patch that closes the empty-block minting path, and the team paused Harmony’s bridges to limit further exposure while it investigates. The patch itself only prevents further unauthorized minting; Harmony has said a separate update addressing the 4 billion tokens already created is still to come.
We are asking all exchanges to block and freeze funds that traces back to these 4 wallet addresses:
one1uap8dx2z0qsjxqthm5flgcxkeepsz3gsrghnfn
0xe7427699427821230177dd13f460d6ce43014510one17u300a40ll5wphd8kj5hktryhdjq3ml9f4phy4
0xf722f7f6afffe8e0dda7b4a97b2c64bb6408efe5… https://t.co/wiR6uQOazW— Harmony (@harmonyprotocol) August 12, 2026
The protocol is also weighing a hard rollback, which would reset the chain’s state to a point before the exploit occurred. That option carries its own tradeoffs: a rollback would erase legitimate transactions processed during the affected window along with the fraudulent mint, and it would revisit the kind of contentious governance decision that has split other networks in the past when chains have faced similar exploits.
A Third Supply Incident in Three Years
This is not Harmony’s first major security failure. The Horizon Bridge was drained of roughly $100 million in June 2022, an attack the FBI later attributed to North Korea’s Lazarus Group. A separate consensus bug in late 2023 improperly minted 146 million tokens, a fraction of Wednesday’s exploit but still a warning sign the network apparently did not fully address. Two token-supply incidents inside three years point to a pattern in how Harmony validates and audits its own minting logic, not an isolated engineering slip.
For holders, the immediate question is whether the rollback proceeds and how exchanges handle the tainted tokens already sitting in their order books. Neither outcome is settled yet, and both will determine whether the current price near $0.0008 holds as a floor or gives way further.