Harmony rolls back chain, wiping 109,000 transactions after forged ONE mint

Harmony will roll back its chain to Aug. 11 checkpoints, discarding 109,126 transactions to purge 4 billion forged ONE tokens, the network said Monday.

"Selectively restoring transactions was unsafe because balances, contract states, nonces and other conditions would differ on the replacement chain," Harmony said in its latest incident update.

The recovery plan retains shard 0 block 92,730,034 and shard 1 block 94,978,278, both recorded at 11:25:37 p.m. UTC on Aug. 11. New blocks will resume at heights 92,730,035 and 94,978,279, with client version v2026.1.2 configured to reject the abnormal block hashes tied to the incident. The first confirmed forged mint hit shard 0 at block 92,730,036, giving the team a one-block safety buffer.

ONE fell more than 50 percent at one point after the exploit and remains down approximately 33.6 percent over 24 hours, with a market cap near $10.8 million, according to CoinGecko data. The rollback puts Harmony alongside Ravencoin, which faces a potential three-day reorganization after its own consensus flaw was exploited.

Why replacement databases, not a simple rewind

Harmony chose to replace the affected shard databases entirely rather than use its existing in-place rewind function. The team said the standard revert function mainly shifts chain heads without fully clearing later receipts, indexes, snapshots and cross-shard data, which could preserve an attack route or cause validators to land on different states.

The team also rejected burning or repairing the forged ONE directly because the tokens had already scattered across exchanges, DEX pools, contracts and countless wallets. A blacklist approach was dismissed for leaving the forged supply technically intact while risking legitimate wallets holding tainted funds. Selectively replaying "clean" transactions was ruled out because the replacement chain's state would differ from the discarded one, meaning identical transactions could produce different results.

Bot activity dominates the discarded window

To measure impact, Harmony built a shard 0 archive spanning blocks 92,730,035 through 92,871,662, covering 141,628 consecutive blocks. Of the 109,126 regular transactions in that range, 104,545 — or 95.80 percent — were automated, with DEX bots accounting for 99,863 transactions split between 75,430 successful swaps and 11,804 failed attempts.

Only 22 transactions were simple native transfers with no obvious dependency, and even those weren't automatically considered safe to replay. Another 860 native transfers raised questions around balances, funding sources, nonces or later spending, while 80,630 transactions depended on contract or blockchain state. All 315 staking transactions depend on chain and epoch state, meaning nothing in that category can be cleanly separated from the reset.

Investigators separately mapped how the counterfeit tokens spread. One wallet linked to the forged mint attempted 534 transfers of 5 billion ONE each within a 106-second window, with 477 succeeding and moving a combined 2.385 trillion ONE. The funds reached standalone wallets, exchange accounts, DEX routers and pools, liquidity provider positions, bridge contracts, wrapped ONE, staking wallets and high-volume service wallets almost immediately.

Harmony said it has made initial progress tracing the hacker and is working with exchanges, bridges and law enforcement. An independent third-party security company reviewed the incident separately and corroborated the forged mint and the main findings of the fund-flow analysis.

The rollback follows Flow's December 2025 decision to abandon a full rollback in favor of targeted token burns after a $3.9 million execution-layer exploit. Harmony's Horizon Bridge lost roughly $100 million in June 2022 after attackers compromised its private keys, an attack the FBI attributed to North Korea's Lazarus Group. The network also handled a smaller staking-system bug in late 2023 that improperly minted about 146.3 million ONE across 74 addresses.

For now, Harmony is working with exchanges and bridges to determine how discarded post-checkpoint activity should be handled and how affected parties might be compensated. Every block created after the two checkpoints will be removed under the proposed recovery, regardless of whether the transaction was related to the forged mint.

This article is for informational purposes only and does not constitute investment advice.