Harmony Protocol — Unauthorized 4B ONE Mint via Cross-Shard Receipt Replay

August 11–14, 2026 — Harmony Protocol's Layer-1 blockchain was exploited via two combined consensus bugs, enabling unauthorized minting of approximately 4 billion ONE tokens (~26% of circulating supply, ~$3.2M realized value).

Two bugs combined: 1. Cross-shard receipt replay: IsSpent/WriteCXReceiptsProofSpent derived the spent-marker key only from the signed block Header — modifying transaction identifiers made already-processed receipts appear as new, enabling double-credits. 2. Quorum verification bypass: IsQuorumAchievedByMask() counted len(mask.Publics) (all keys listed in the signature mask) instead of actual signers — a message with a sufficiently long key list passed the quorum threshold with zero valid signatures.

23:25:41 UTC, Aug 11: First anomalous activity on Shard 0, block 92730036.

00:02:59 UTC, Aug 12: 1 billion ONE minted (tx 1). 00:12 UTC: 111M ONE feeder split (tx 0x54d2109e...). 00:33 UTC: 266.9M ONE feeder chunk (tx 0x05644dd8...). 01:01:17 UTC: 3 billion ONE minted (tx 2) to wallet one1a5hur...8xgd7. 01:02:31 UTC: 2.8B ONE transferred to KuCoin deposit address (tx 0xec10b454..., block 92732935 — confirmed Harmony Explorer). ~97% of total minted ONE reaches exchanges.

04:42 UTC: @the_juice_berg (Juiceberg) publishes first public alert — 'Harmony exploited as on-chain data reveals unauthorized 4B ONE mint (26% of supply) via empty blocks, with 2.8B quickly funneled to exchanges as price crashed while totalSupply endpoint hides the inflation.'

05:25 UTC: Harmony publishes the 4 attacker wallet addresses and asks all exchanges to block and freeze associated funds.

05:31:51 UTC: 5B ONE transferred between attacker wallets (one1h56hk...47vy → one1uap8...hnfn, tx 0xf7a11bc0..., block 92740992 — confirmed Harmony Explorer).

~06:30 UTC: Emergency validator patch v2026.1.1 (PR #5101, 'Cx receipt fixes' by @Frozen, commit e9a05f6) distributed. Bridge.harmony.one paused.

07:26 UTC: @harmonyprotocol confirms the exploit officially (tweet 2087395174263705704).

Aug 12 (Asian market hours): ONE price crashes -39.22% to $0.000750. 24h volume spikes to 9.19B ONE on Bitget.

Aug 12, 10:31 UTC: Harmony reports 10,288 transfers traced across 409 wallets.

Aug 13: Harmony Aug 13 incident update — reconstruction indicates up to ~3.01 trillion ONE total via 6 forged cross-shard transactions (vs. initial 4B first-wave estimate). Rollback targeting Shard 0 block 92730034 and Shard 1 block 94,978,278 under evaluation. Shard 0 paused at block 92,753,555.

Aug 14: 53% of validators have installed the patch. 5B ONE remain in wallet one1uap8...hnfn (confirmed Harmony Explorer — balance $3.62M). Rollback not yet confirmed. ZachXBT declined to assist (citing lack of compensation for prior 2022 work).