Verify a decision

{"actor":"system:backfill","investigation_id":"c3a88929-042e-42c6-95f4-56dfd85cbaf7","kind":"publish","page_slug":"harmony-protocol-2026-one-token-exploit-and-l1-shutdown","published_at":"2026-09-12T17:13:40.611Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Harmony Protocol (2026 ONE Token Exploit and L1 Shutdown)","sections":[{"content":"Harmony confirmed on Wednesday, August 12, 2026 that its Layer 1 network had been exploited after an attacker minted unauthorized ONE tokens using a flaw related to cross-shard receipt processing, which allowed valid receipts to be re-executed inside empty blocks to create new tokens without any corresponding debit elsewhere on the network. Initial reporting put the unauthorized mint at approximately 4 billion ONE tokens, equivalent to roughly 26% of the token's then-existing circulating supply. The ONE price fell approximately 40% within 24 hours of the exploit becoming public. Of the minted tokens, approximately 2.8 billion were moved to attacker-controlled addresses, with an estimated 97% of that amount funneled directly to exchanges, according to on-chain analysis cited in early reporting. Harmony stated it was working with exchanges to freeze attacker-linked funds, paused its token bridge, and pushed an emergency software update while it developed a patch and evaluated rollback options.","heading":"August 2026 Unauthorized Minting Exploit","severity":"critical","sources":[{"credibility":2,"name":"Harmony confirms exploit involving unauthorized minting of 4 billion ONE tokens - The Block","type":"news_article","url":"https://www.theblock.co/news/defi/2026-08-12-harmony-confirms-exploit-one-token-411527"},{"credibility":2,"name":"Harmony's ONE dives 40% after an attack appears to mint tokens equal to quarter of supply - CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2026/08/12/harmony-s-one-falls-26-after-attacker-allegedly-mints-4-billion-tokens"},{"credibility":2,"name":"Harmony Devs Confirm Major Exploit Involving Unauthorized Creation Of ONE Crypto Tokens - Crowdfund Insider","type":"news_article","url":"https://www.crowdfundinsider.com/2026/08/296418-harmony-devs-confirm-major-exploit-involving-unauthorized-creation-of-one-crypto-tokens/"}]},{"content":"The publicly confirmed scope of the exploit grew substantially in the days following the initial disclosure. While the August 12, 2026 confirmation cited approximately 4 billion unauthorized ONE tokens, Harmony's August 17, 2026 rollback announcement disclosed that the attacker had in fact forged approximately 3.01 trillion ONE tokens across six transactions sent to four exploiter-controlled wallets — with nearly 2.4 trillion of that total moved in under two minutes, valued at an estimated $3 billion at pre-attack prices. This is a large discrepancy from the initial ~4 billion figure, and reporting on the exact total forged amount has varied between roughly 2.385 trillion and 3.01 trillion ONE across different outlets; the scale of the incident should be treated as having been understated in the first 24-48 hours and only fully clarified after further forensic review. This escalation itself — from a nine-figure incident to a multi-billion-dollar one within roughly a week — is treated here as a material finding independent of the exact final figure.","heading":"Scale of the Exploit Escalated Sharply During Investigation","severity":"critical","sources":[{"credibility":2,"name":"Harmony plans pre-attack rollback after exploiter forged 3 trillion ONE tokens - The Block","type":"news_article","url":"https://www.theblock.co/news/ecosystems/2026-08-17-harmony-plans-pre-attack-rollback-after-exploiter-forged-3-trillion-one-tokens-411976"},{"credibility":2,"name":"Harmony Will Roll Back Its Blockchain to Erase 3 Trillion Forged Tokens - CoinPaprika","type":"news_article","url":"https://coinpaprika.com/news/harmony-roll-back-blockchain-erase-3-trillion/"},{"credibility":2,"name":"Harmony to Roll Back Blockchain to Pre-Attack State After Counterfeit ONE Minting Exploit - CryptoRank.io","type":"news_article","url":"https://cryptorank.io/news/feed/36e8b-harmony-blockchain-rollback-counterfeit-one-attack"}]},{"content":"Rather than burning the forged tokens, blacklisting attacker wallets, or pursuing a token migration, Harmony chose to reset both of its shards to a fixed pre-attack checkpoint. Validators reverted Shard 0 to block 92,730,034 and Shard 1 to block 94,978,278, both corresponding to August 11, 2026 at 23:25:37 UTC, shortly before the first confirmed forged mint. The rollback discarded all subsequent legitimate activity within that window, including an estimated 109,126 regular transactions and 315 staking transactions that had nothing to do with the exploit. Harmony's team defended the choice, stating: \"Of the options we studied, one fixed rollback window is the fairest and most secure. It applies one rule to everyone, removes the forged state, and carries the lowest risk of another attack or consensus failure.\" The decision drew criticism because it required coordinated intervention by the core development team and validators to effectively rewrite recent chain history, which commentators say is in tension with blockchain's foundational claim of immutability and raises questions about how decentralized Harmony's validator set actually is in practice. On-chain investigator ZachXBT publicly stated he would not track the incident for free, reportedly citing Harmony's earlier failure to compensate individuals who helped freeze funds after the 2022 Horizon Bridge hack — criticism that drew both support and pushback but underscored unresolved trust and accountability concerns around the protocol's incident response.","heading":"Full Blockchain Rollback and Immutability Controversy","severity":"critical","sources":[{"credibility":2,"name":"Harmony plans pre-attack rollback after exploiter forged 3 trillion ONE tokens - The Block","type":"news_article","url":"https://www.theblock.co/news/ecosystems/2026-08-17-harmony-plans-pre-attack-rollback-after-exploiter-forged-3-trillion-one-tokens-411976"},{"credibility":2,"name":"Harmony Protocol Plans Network Rollback After Token Forgery Exploit, Raising Blockchain Immutability And Lack Of Decentralization Concerns - Crowdfund Insider","type":"news_article","url":"https://www.crowdfundinsider.com/2026/08/298395-harmony-protocol-plans-network-rollback-after-token-forgery-exploit-raising-blockchain-immutability-and-lack-of-decentralization-concerns/"},{"credibility":2,"name":"Harmony to Roll Back Blockchain After Attack Issuing Trillions of ONE - ForkLog","type":"news_article","url":"https://forklog.com/en/harmony-to-roll-back-blockchain-after-attack-issuing-trillions-of-one/"}]},{"content":"On September 6, 2026, less than a month after the exploit, Harmony announced a proposal to fully sunset its Layer 1 blockchain and migrate the native ONE token to Ethereum as an ERC-20 asset. Harmony's team stated: \"The threats posed by state actors and AI agents are too great. Since our mainnet launch in 2019, our community has been resilient through attacks and changes — but it is time to fully sunset the Harmony network.\" Under the proposal, ONE balances would be captured in a final snapshot and holders, delegators and validators would receive an automatic airdrop of equivalent ERC-20 tokens on Ethereum with no action required and total supply/emission rate unchanged. Harmony also proposed redirecting future token emissions toward a new \"Remix Economy for AI Video\" initiative. A $1.372 million compensation pool, paid in quarterly installments, was proposed for validators who sunset their nodes on schedule, maintain their stakes, sign an agreement, and transition into a new \"governor\" role. As of this writing (September 12, 2026), the proposal remains non-binding, no final Layer 1 shutdown date has been set, and Harmony has not confirmed whether the plan will go through a formal on-chain governance vote.","heading":"Proposed Full Layer 1 Shutdown and Migration to Ethereum","severity":"high","sources":[{"credibility":2,"name":"Harmony to fully sunset Layer 1, proposes token migration to Ethereum - The Block","type":"news_article","url":"https://www.theblock.co/news/web3/2026-09-06-harmony-sunset-network-413635"},{"credibility":2,"name":"Harmony Proposes Layer-1 Shutdown With ONE Migration to Ethereum - TheCryptoBasic","type":"news_article","url":"https://thecryptobasic.com/2026/09/07/harmony-proposes-layer-1-shutdown-with-one-migration-to-ethereum/"},{"credibility":2,"name":"Harmony Cites AI Threats in Proposed Blockchain Shutdown - Decrypt","type":"news_article","url":"https://decrypt.co/377579/harmony-ai-threats-blockchain-shutdown"}]},{"content":"As part of the shutdown/migration plan, Harmony instructed users to exit all smart-contract positions — including DeFi protocols, liquidity pools, and other on-chain applications — before September 10, 2026, when validators would be permitted to begin ceasing node operations. The migration snapshot is designed to capture tokens held in ordinary wallets, staking delegations, validator rewards, and balances on centralized exchanges, but Harmony has explicitly stated that assets held in multisig safes, liquidity pools, and other on-chain applications cannot be migrated automatically. Users who fail to withdraw funds from such positions before the network is wound down face the risk of permanent, irreversible loss of those assets. This places a real, near-term burden on end users to take manual action on a compressed timeline, with no formal on-chain governance vote confirmed and no final shutdown date announced as of September 12, 2026.","heading":"User Asset Risk: Mandatory Smart Contract Exit Deadline","severity":"critical","sources":[{"credibility":2,"name":"Harmony sets Sept. 10 deadline for ONE holders to exit DeFi - crypto.news","type":"news_article","url":"https://crypto.news/harmony-sets-sept-10-deadline-for-one-holders-to-exit/"},{"credibility":2,"name":"Harmony to fully sunset Layer 1, proposes token migration to Ethereum - The Block","type":"news_article","url":"https://www.theblock.co/news/web3/2026-09-06-harmony-sunset-network-413635"},{"credibility":2,"name":"Harmony Proposes Layer-1 Shutdown With ONE Migration to Ethereum - TheCryptoBasic","type":"news_article","url":"https://thecryptobasic.com/2026/09/07/harmony-proposes-layer-1-shutdown-with-one-migration-to-ethereum/"}]},{"content":"The August 2026 minting exploit is Harmony's third publicly documented major token-supply security incident. In June 2022, Harmony's Horizon Bridge was hacked for approximately $100 million, an attack the FBI later attributed to North Korea's Lazarus Group and APT38 in January 2023; that incident is the subject of a separate, existing AVOID.NET investigation and is referenced here only as background pattern evidence. In December 2023, a bug in Harmony's staking/undelegation logic led to the improper minting of approximately 146.3 million ONE tokens across 74 addresses, with roughly 16.4 million ONE moved to an exchange before Harmony issued an emergency patch and blacklisted the affected addresses. Taken together with the August 2026 exploit and subsequent full rollback, this represents a recurring inability to prevent unauthorized token issuance on the network across at least three separate incidents over four years, which is directly cited by Harmony itself as a reason for abandoning the Layer 1 chain entirely.","heading":"Pattern of Repeated Security Incidents","severity":"high","sources":[{"credibility":2,"name":"Harmony's ONE dives 40% after an attack appears to mint tokens equal to quarter of supply - CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2026/08/12/harmony-s-one-falls-26-after-attacker-allegedly-mints-4-billion-tokens"},{"credibility":2,"name":"Inside the Harmony spat over a bug that created $2.2m in tokens - DL News","type":"news_article","url":"https://www.dlnews.com/articles/people-culture/harmony-devs-spat-over-a-bug-that-created-millions-in-tokens/"}]}],"sources_used":[{"credibility":2,"name":"Harmony confirms exploit involving unauthorized minting of 4 billion ONE tokens - The Block","type":"news_article","url":"https://www.theblock.co/news/defi/2026-08-12-harmony-confirms-exploit-one-token-411527"},{"credibility":2,"name":"Harmony's ONE dives 40% after an attack appears to mint tokens equal to quarter of supply - CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2026/08/12/harmony-s-one-falls-26-after-attacker-allegedly-mints-4-billion-tokens"},{"credibility":2,"name":"Harmony Devs Confirm Major Exploit Involving Unauthorized Creation Of ONE Crypto Tokens - Crowdfund Insider","type":"news_article","url":"https://www.crowdfundinsider.com/2026/08/296418-harmony-devs-confirm-major-exploit-involving-unauthorized-creation-of-one-crypto-tokens/"},{"credibility":2,"name":"Harmony plans pre-attack rollback after exploiter forged 3 trillion ONE tokens - The Block","type":"news_article","url":"https://www.theblock.co/news/ecosystems/2026-08-17-harmony-plans-pre-attack-rollback-after-exploiter-forged-3-trillion-one-tokens-411976"},{"credibility":2,"name":"Harmony Will Roll Back Its Blockchain to Erase 3 Trillion Forged Tokens - CoinPaprika","type":"news_article","url":"https://coinpaprika.com/news/harmony-roll-back-blockchain-erase-3-trillion/"},{"credibility":2,"name":"Harmony to Roll Back Blockchain to Pre-Attack State After Counterfeit ONE Minting Exploit - CryptoRank.io","type":"news_article","url":"https://cryptorank.io/news/feed/36e8b-harmony-blockchain-rollback-counterfeit-one-attack"},{"credibility":2,"name":"Harmony Protocol Plans Network Rollback After Token Forgery Exploit, Raising Blockchain Immutability And Lack Of Decentralization Concerns - Crowdfund Insider","type":"news_article","url":"https://www.crowdfundinsider.com/2026/08/298395-harmony-protocol-plans-network-rollback-after-token-forgery-exploit-raising-blockchain-immutability-and-lack-of-decentralization-concerns/"},{"credibility":2,"name":"Harmony to Roll Back Blockchain After Attack Issuing Trillions of ONE - ForkLog","type":"news_article","url":"https://forklog.com/en/harmony-to-roll-back-blockchain-after-attack-issuing-trillions-of-one/"},{"credibility":2,"name":"Harmony to fully sunset Layer 1, proposes token migration to Ethereum - The Block","type":"news_article","url":"https://www.theblock.co/news/web3/2026-09-06-harmony-sunset-network-413635"},{"credibility":2,"name":"Harmony Proposes Layer-1 Shutdown With ONE Migration to Ethereum - TheCryptoBasic","type":"news_article","url":"https://thecryptobasic.com/2026/09/07/harmony-proposes-layer-1-shutdown-with-one-migration-to-ethereum/"},{"credibility":2,"name":"Harmony Cites AI Threats in Proposed Blockchain Shutdown - Decrypt","type":"news_article","url":"https://decrypt.co/377579/harmony-ai-threats-blockchain-shutdown"},{"credibility":2,"name":"Harmony sets Sept. 10 deadline for ONE holders to exit DeFi - crypto.news","type":"news_article","url":"https://crypto.news/harmony-sets-sept-10-deadline-for-one-holders-to-exit/"},{"credibility":2,"name":"Inside the Harmony spat over a bug that created $2.2m in tokens - DL News","type":"news_article","url":"https://www.dlnews.com/articles/people-culture/harmony-devs-spat-over-a-bug-that-created-millions-in-tokens/"}],"summary":"In August 2026, Harmony's Layer 1 blockchain suffered a critical unauthorized-minting exploit that began with roughly 4 billion forged ONE tokens (about 26% of supply) and, as investigation continued, was disclosed to involve trillions of forged tokens across multiple transactions, crashing the ONE price roughly 40%. Harmony responded with a full blockchain rollback of its two shards to a pre-attack checkpoint — an action critics say undermines blockchain immutability and highlights centralized control by the core team and validators. On September 6, 2026, Harmony proposed fully shutting down its Layer 1 network and migrating the ONE token to Ethereum as an ERC-20 asset, citing threats from \"state actors and AI agents,\" with users told to exit all smart-contract positions before a September 10, 2026 snapshot deadline or risk permanent loss of assets not eligible for automatic migration.","timeline":[{"date":"2022-06","event":"Harmony's Horizon Bridge is hacked for approximately $100 million, later attributed by the FBI to North Korea's Lazarus Group and APT38 (covered separately on AVOID.NET under the existing harmony-protocol page; included here for background pattern only).","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2026/08/12/harmony-s-one-falls-26-after-attacker-allegedly-mints-4-billion-tokens"},{"date":"2023-12","event":"A bug in Harmony's staking/undelegation logic improperly mints approximately 146.3 million ONE tokens across 74 addresses; Harmony issues an emergency patch and blacklists affected addresses.","source":"DL News","source_url":"https://www.dlnews.com/articles/people-culture/harmony-devs-spat-over-a-bug-that-created-millions-in-tokens/"},{"date":"2026-08-11","date_evidence":"Both blocks correspond to August 11, 2026, at 23:25:37 UTC.","event":"Attacker begins exploiting a cross-shard receipt processing flaw to mint unauthorized ONE tokens; this timestamp later becomes the rollback checkpoint used by validators.","source":"ForkLog","source_url":"https://forklog.com/en/harmony-to-roll-back-blockchain-after-attack-issuing-trillions-of-one/"},{"date":"2026-08","date_evidence":"Harmony first confirmed the exploit on Aug. 12 after an unauthorized minting","date_original":"2026-08-12","event":"Harmony publicly confirms the exploit; initial reporting cites approximately 4 billion unauthorized ONE tokens minted (about 26% of supply); ONE price falls roughly 40%.","source":"The Block","source_url":"https://www.theblock.co/news/ecosystems/2026-08-17-harmony-plans-pre-attack-rollback-after-exploiter-forged-3-trillion-one-tokens-411976"},{"date":"2026-08-17","date_evidence":"August 17, 2026, 11:06AM EDT","event":"Harmony discloses the true scale of the exploit is far larger than first reported — approximately 3.01 trillion ONE forged across six transactions to four wallets — and announces plans for a full blockchain rollback rather than a token burn, blacklist, or migration.","source":"The Block","source_url":"https://www.theblock.co/news/ecosystems/2026-08-17-harmony-plans-pre-attack-rollback-after-exploiter-forged-3-trillion-one-tokens-411976"},{"date":"2026-08","event":"Validators execute the rollback of Shard 0 and Shard 1 to the pre-attack checkpoint, discarding an estimated 109,126 regular transactions and 315 staking transactions confirmed after the checkpoint.","source":"The Block / CryptoRank","source_url":"https://cryptorank.io/news/feed/36e8b-harmony-blockchain-rollback-counterfeit-one-attack"},{"date":"2026-09","date_evidence":"Harmony announced Sunday that it plans to sunset its Layer 1 blockchain","date_original":"2026-09-06","event":"Harmony announces a proposal to fully shut down its Layer 1 network and migrate the ONE token to Ethereum as an ERC-20 asset, citing threats from \"state actors and AI agents.\"","source":"The Block","source_url":"https://www.theblock.co/news/web3/2026-09-06-harmony-sunset-network-413635"},{"date":"2026-09-10","date_evidence":"users are urged to exit all smart contracts before September 10, 2026","event":"Deadline for users to exit smart-contract positions; validators are permitted to begin ceasing node operations. Assets in multisig safes, liquidity pools, and on-chain applications cannot be migrated automatically.","source":"The Block","source_url":"https://www.theblock.co/news/web3/2026-09-06-harmony-sunset-network-413635"}]},"v":1}