Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #1[disputed][awaiting moderator]in the summary

   “On August 12, 2026, an unidentified attacker exploited two consensus-layer vulnerabilities in the Harmony ONE mainnet to mint approximately 4 billion unauthorized ONE tokens, inflating the circulating supply by roughly 26%.”

   reviewerThe attacker minted approximately 4 billion unauthorized ONE tokens, inflating supply by roughly 26%, and this is presented as the scale of the exploit.The page treats 4 billion as the total scale of the exploit throughout the summary and Market Impact section, but this was only the initial publicly-flagged figure. Harmony's fuller investigation (reported ~August 17, by the page's own cited Lookonchain source and independently by The Block, CrowdFund Insider, and others) found roughly 3.01 trillion ONE forged across six transactions into four wallets — about 750x larger than the figure the page presents as the total.
   Proposed correction (not yet applied)

   On August 12, 2026, an unidentified attacker exploited two consensus-layer vulnerabilities in the Harmony ONE mainnet to mint an initial 4 billion unauthorized ONE tokens, a figure Harmony's own on-chain reconstruction later revised to approximately 3.01 trillion ONE forged across six cross-shard transactions into four attacker wallets, far exceeding the initially reported 26% supply inflation.
   citedwww.coindesk.com/markets/2026/08/12/harm…4-billion-tokensx.com/harmonyprotocol/article/2088078119269978281
2. #11[disputed][awaiting moderator]in section: Market Impact

   “The value of the 4 billion minted tokens at post-crash prices was estimated at roughly $3.2 million.”

   reviewerThe value of the 4 billion minted tokens at post-crash prices was estimated at roughly $3.2 million.Same underlying defect as the summary's total-minted-amount claim: the page's dollar-value estimate is scoped only to the initially reported 4 billion tokens, understating the scale of the incident by roughly three orders of magnitude relative to the ~3.01 trillion ONE Harmony's own investigation later confirmed was forged.
   Proposed correction (not yet applied)

   The value of the initially reported 4 billion minted tokens at post-crash prices was estimated at roughly $3.2 million; Harmony's fuller investigation later found the total forged amount was approximately 3.01 trillion ONE, valued far higher (one wallet's 2.385 trillion ONE transfer alone was estimated near $3 billion at pre-attack prices).
   citeddefimon.xyz/blog/harmony-hack-august-2026
3. #14[disputed][awaiting moderator]in section: Emergency Response and Patch

   “Harmony deployed emergency patch Mainnet v2026.1.1 (pull request #5101) at approximately 06:30 UTC on August 12, 2026 — roughly five hours after the first unauthorized mint and approximately 65 minutes after the exploit became public.”

   reviewerHarmony deployed patch Mainnet v2026.1.1 (PR #5101) at approximately 06:30 UTC on August 12, 2026, patching both vulnerabilities.The patch/PR name, version and 06:30 UTC deployment time are confirmed. However, sourcing found repeatedly ties the 'five hours' figure to the gap between the analyst's public post and the patch -- the opposite of how the page attributes it (mint-to-patch). The '65 minutes' figure could not be corroborated in any source consulted and may be a fabricated or misattributed detail.
   Proposed correction (not yet applied)

   Harmony deployed emergency patch Mainnet v2026.1.1 (pull request #5101) at approximately 06:30 UTC on August 12, 2026 — roughly five hours after the exploit was first publicly flagged by an independent analyst.
   citedx.com/harmonyprotocol/article/2088078119269978281

No source the reviewer could reach confirms or contradicts the claim.

1. #12[unverifiable][awaiting moderator]in section: Market Impact

   “The token ranked outside the top 1,000 cryptocurrencies by market cap following the crash.”

   reviewerThe token ranked outside the top 1,000 cryptocurrencies by market cap following the crash.Could not independently confirm a specific market-cap ranking figure from any source consulted; plausible given the reported market cap but not directly verifiable.
   citeddefimon.xyz/blog/harmony-hack-august-2026
2. #13[unverifiable][awaiting moderator]in section: Market Impact

   “Longer-term price context shows ONE had already declined approximately 36% over the prior 30 days and 62% over the prior 90 days before the exploit occurred.”

   reviewerONE had already declined approximately 36% over the prior 30 days and 62% over the prior 90 days before the exploit occurred.The general downtrend is corroborated qualitatively, but the specific 36%/62% figures could not be confirmed against any source consulted.
   citeddefimon.xyz/blog/harmony-hack-august-2026
3. #20[unverifiable][awaiting moderator]in section: Blockchain Rollback

   “approximately 96% of which were reported to be automated DEX activity”

   reviewerApproximately 96% of the erased transactions were reported to be automated DEX activity.Could not locate independent corroboration for the specific 96% DEX-activity figure in any source consulted.
   citeddefimon.xyz/blog/harmony-hack-august-2026

The cited evidence supports part of the claim but not all of it.

1. #18[partially supported][awaiting moderator]in section: Blockchain Rollback

   “A second stage of the rollback procedure was activated on approximately August 20, 2026. Post-rollback, both shards were reported stable for 24+ hours, producing approximately 100,000 blocks and advancing from epoch 3002 to 3004 with near-full validator signing participation.”

   reviewerA second stage of the rollback was activated ~August 20, 2026; both shards stable 24+ hours, ~100,000 blocks, epoch 3002 to 3004, near-full signing participation.The underlying facts are corroborated by a fixed, dated article (Bloomingbit, Aug 22), which reports these same figures as part of a completion announcement -- two days after the timeline entry's Aug 20 date for 'activation.' The cited CoinMarketCap AI page is a live, non-static aggregator whose content can change over time, making it a weaker long-term citation than the fixed article that actually substantiates the figures.
   citedcoinmarketcap.com/cmc-ai/harmony/latest-updates/
2. #23[partially supported][awaiting moderator]in section: Attacker Identity and Wallet Addresses

   “Harmony published four wallet addresses associated with the exploit and shared these with exchanges and LayerZero for freezing purposes: one1uap8dx2z0qsjxqthm5flgcxkeepsz3gsrghnfn (0xe7427699427821230177dd13f460d6ce43014510) and one17u300a40ll5wphd8kj5hktryhdjq3ml9f4phy4 (0xf722f7f6afffe8e0dda7b4a97b2c64bb6408efe5).”

   reviewerHarmony published four wallet addresses associated with the exploit, listed as one1uap8dx2z0qsjxqthm5flgcxkeepsz3gsrghnfn and one17u300a40ll5wphd8kj5hktryhdjq3ml9f4phy4 (with hex equivalents).The claim that Harmony published four wallet addresses is accurate, but the section lists only two of the four actual distinct wallets, omitting one1a5hur07z5vtvzhr35zkw8tfqedemkz8t88xgd7 and one1h56hkxmua0uzfv07fu04cudvtrl35u96pq47vy.
   citedx.com/harmonyprotocol/article/2088078119269978281
3. #25[partially supported][awaiting moderator]in the timeline

   “Harmony formally proposes a full blockchain rollback targeting Shard 0 block 92,730,034 and Shard 1 block 94,978,278 (both at 23:25:37 UTC, August 11). Rollback would erase approximately 109,126 regular and 315 staking transactions.”

   reviewerHarmony formally proposed the rollback on August 17, targeting the stated blocks, erasing ~109,126 regular and 315 staking transactions.Block numbers and erased-transaction counts are accurate, but the entry omits the pivotal fact -- reported the same day by the same class of sources the page relies on elsewhere -- that the rollback was prompted by discovery of a ~3.01 trillion ONE total forgery, not the 4 billion figure emphasized throughout the rest of the page.
   citeddefimon.xyz/blog/harmony-hack-august-2026

The cited evidence supports the claim as written.

1. #2[confirmed][no action needed]in the summary

   “Approximately 97% of the minted tokens reached cryptocurrency exchange deposit wallets before freezes could be enacted.”

   reviewerApproximately 97% of the minted tokens reached exchange deposit wallets before freezes could be enacted.Consistently corroborated across independent tier-1 and tier-2 outlets.
   citedwww.coindesk.com/markets/2026/08/12/harm…4-billion-tokens
2. #3[confirmed][no action needed]in the summary

   “Harmony deployed an emergency patch within roughly five hours, suspended its cross-chain bridge, and subsequently executed a full blockchain rollback to the pre-exploit state of August 11, 2026, erasing more than 109,000 legitimate transactions in the process.”

   reviewerHarmony deployed an emergency patch within roughly five hours, suspended its bridge, and executed a full rollback erasing more than 109,000 legitimate transactions.General framing is accurate; the more specific timing claim in the Emergency Response section is separately disputed.
   citedfinance.yahoo.com/markets/crypto/article…n-064216020.html
3. #4[confirmed][no action needed]in section: Incident Overview

   “The attacker executed at least two minting events: 1 billion ONE at block 92,731,152 (00:02:59 UTC, August 12) and 3 billion ONE at block 92,732,898 (01:01:17 UTC, August 12).”

   reviewerThe attacker executed at least two minting events: 1 billion ONE at block 92,731,152 and 3 billion ONE at block 92,732,898.Matches the officially confirmed first-wave mint figures; note this describes only the initial wave, not the full scope later discovered (see disputed total-amount finding).
   citedx.com/harmonyprotocol/article/2088078119269978281
4. #5[confirmed][no action needed]in section: Incident Overview

   “On-chain analysis by independent researcher Juiceberg estimated that approximately 97% of the minted tokens reached exchange deposit wallets before any freeze could take effect.”

   reviewerOn-chain analysis by independent researcher Juiceberg estimated ~97% of minted tokens reached exchange wallets before freeze, and flagged the anomaly before Harmony's acknowledgment.Corroborated.
   citedwww.coindesk.com/markets/2026/08/12/harm…4-billion-tokens
5. #6[confirmed][no action needed]in section: Incident Overview

   “The token's price fell between 30% and 40% intraday to roughly $0.0008, an all-time low, with market capitalization falling to approximately $10.6–11.5 million.”

   reviewerPrice fell 30-40% intraday to roughly $0.0008 (an all-time low), with market cap falling to approximately $10.6-11.5 million.Different outlets reported 30-40% declines and slightly different price lows ($0.00057-$0.0008); the page's hedged range is consistent with the spread of reporting.
   citedwww.coindesk.com/markets/2026/08/12/harm…4-billion-tokens
6. #7[confirmed][no action needed]in section: Incident Overview

   “The totalSupply endpoint failed to reflect the minted tokens during the critical early window, delaying detection by exchanges and dashboards.”

   reviewerThe totalSupply endpoint failed to reflect the minted tokens during the critical early window, delaying detection.Corroborated by multiple outlets.
   citeddefimon.xyz/blog/harmony-hack-august-2026
7. #8[confirmed][no action needed]in section: Technical Root Cause

   “The first was a pre-staking quorum verification flaw: the consensus code counted every public key listed in a signature mask rather than the validators who had actually signed the message.”

   reviewerThe pre-staking quorum verification flaw counted every public key in a signature mask rather than actual signers, allowing zero-signature transactions to pass.Consistent across sources describing the root cause.
   citedx.com/harmonyprotocol/article/2088078119269978281defimon.xyz/blog/harmony-hack-august-2026
8. #9[confirmed][no action needed]in section: Technical Root Cause

   “The second vulnerability was a cross-shard receipt replay flaw: certain proof fields in cross-shard receipts were not cryptographically bound to the signed block header, allowing a previously processed receipt to be presented as new, thereby enabling double-crediting of tokens without corresponding debits.”

   reviewerThe cross-shard receipt replay flaw allowed previously processed receipts to be replayed, enabling double-crediting without corresponding debits.Corroborated.
   citedwww.lookonchain.com/feeds/68301defimon.xyz/blog/harmony-hack-august-2026
9. #10[confirmed][no action needed]in section: Technical Root Cause

   “One wallet alone reportedly pushed 2.385 trillion forged ONE through 477 transfers in approximately 106 seconds according to on-chain reconstruction reported by DeFiMon.”

   reviewerOne wallet pushed 2.385 trillion forged ONE through 477 transfers in approximately 106 seconds, per DeFiMon's reconstruction.Precise figures (2.385 trillion, 477 transfers, 106 seconds) are independently corroborated. Note this sits awkwardly next to the page's repeated '4 billion' total framing elsewhere -- a wallet cannot move 2.385 trillion forged tokens if only 4 billion were minted in total, which is itself evidence the page's headline total is understated (see disputed finding on summary).
   citeddefimon.xyz/blog/harmony-hack-august-2026
10. #15[confirmed][no action needed]in section: Emergency Response and Patch

    “Shard 0 was halted at block 92,753,555 as part of the containment effort.”

    reviewerShard 0 was halted at block 92,753,555 as part of the containment effort.Corroborated.
    citedx.com/harmonyprotocol/article/2088078119269978281
11. #16[confirmed][no action needed]in section: Blockchain Rollback

    “The rollback target was block 92,730,034 on Shard 0 and block 94,978,278 on Shard 1, both corresponding to the chain state at 23:25:37 UTC on August 11, 2026, shortly before the first confirmed forged mint.”

    reviewerRollback target was Shard 0 block 92,730,034 and Shard 1 block 94,978,278, both corresponding to 23:25:37 UTC on August 11, 2026.Precisely corroborated.
    citedfinance.yahoo.com/markets/crypto/article…n-064216020.htmlwww.crowdfundinsider.com/2026/08/298395-…zation-concerns/
12. #17[confirmed][no action needed]in section: Blockchain Rollback

    “Harmony confirmed the rollback on approximately August 17–18, 2026. Validators received new databases, and the network resumed operations from blocks #92,730,035 and #94,978,279 respectively.”

    reviewerHarmony confirmed the rollback on approximately August 17-18, 2026; validators received new databases and resumed from blocks #92,730,035 and #94,978,279.Consistent with reporting timeline (proposal ~Aug 17, execution confirmed ~Aug 18).
    citedforklog.com/en/harmony-to-roll-back-bloc…rillions-of-one/
13. #19[confirmed][no action needed]in section: Blockchain Rollback

    “The rollback erased an estimated 109,126 regular and 315 staking transactions”

    reviewerThe rollback erased an estimated 109,126 regular and 315 staking transactions.Precise figures corroborated.
    citedwww.crowdfundinsider.com/2026/08/298395-…zation-concerns/
14. #21[confirmed][no action needed]in section: Blockchain Rollback

    “The rollback raised questions about blockchain finality and decentralization, as noted by CrowdFund Insider, since it required coordinated action among validators to unilaterally reverse confirmed blocks.”

    reviewerThe rollback raised questions about blockchain finality and decentralization, as noted by CrowdFund Insider.Accurately characterizes the cited source.
    citedwww.crowdfundinsider.com/2026/08/298395-…zation-concerns/
15. #22[confirmed][no action needed]in section: Attacker Identity and Wallet Addresses

    “As of the time of this writing, the attacker's identity has not been publicly confirmed or attributed by Harmony, law enforcement, or any independent security researcher.”

    reviewerAs of this writing, the attacker's identity has not been publicly confirmed or attributed, and no law enforcement action has been announced.No source consulted contradicts this; consistent with the state of public reporting as of the review date.
    citedx.com/harmonyprotocol/article/2088078119269978281defimon.xyz/blog/harmony-hack-august-2026
16. #24[confirmed][no action needed]in section: Distinction from 2022 Horizon Bridge Hack

    “This August 2026 incident is distinct from the June 2022 Horizon bridge hack, in which approximately $100 million in assets were drained from Harmony's cross-chain bridge through a private key compromise.”

    reviewerThe June 2022 Horizon bridge hack drained approximately $100 million through a private key compromise, and is distinct from this 2026 incident.Well-established and independently corroborated; the two incidents are correctly distinguished by attack surface.
    citedcryptoslate.com/harmony-weighs-a-full-bl…billions-in-one/