Article Contributors

Harmony Proposes Network Rollback to Purge Trillions in Forged ONE Tokens

Engineers behind Harmony have presented a comprehensive recovery plan to rewind the blockchain ledger following an unauthorized minting event that flooded the ecosystem with unauthorized ONE tokens.

To permanently excise the inflated supply, validators are preparing to reset state databases to specific block targets established on August 11, a decision that will invalidate more than 109,000 recorded interactions.

Anatomy of the Token Forge Exploit

Security analysts traced the incident to a rapid-fire sequence where an unauthorized address triggered 534 separate minting calls for 5 billion ONE apiece in just 106 seconds. Exactly 477 of these transactions completed, resulting in the sudden creation of 2.385 trillion fake tokens on shard 0.

Within moments, the compromised funds spread across decentralized trading venues, cross-chain bridge gateways, lending protocols, and centralized exchange deposit infrastructure. Automated trading bots rapidly absorbed the inflated supply, scattering the counterfeit tokens throughout various liquidity pools.

Subsequent tracing confirmed that while isolated balances could theoretically be targeted, tokens that merged into shared liquidity structures or exchange hot wallets cannot be extracted without damaging innocent user balances.

Mechanics Behind the Network Reset

Rather than relying on built-in ledger reversion functions—which often leave residual index artifacts and cross-shard data intact—the development core opted for a complete database replacement.

Validators will freeze history at block 92,730,034 for shard 0 and block 94,978,278 for shard 1, both sharing an official timestamp of 11:25:37 p.m. UTC on August 11.

To guarantee nodes do not re-sync along the malicious path, client version v2026.1.2 explicitly instructs software to reject all block signatures generated after the target checkpoint.

Alternative mitigation proposals—including selective transaction replays, targeted token burns, address blacklists, and full asset migrations—were evaluated and discarded due to high technical risks or severe operational disruption.

Transaction Removal and Collateral Impact

To quantify the scope of discarded activity, teams compiled a detailed archive spanning 141,628 consecutive blocks from the incident horizon onward. The dataset captures 109,126 standard executions along with 315 staking entries. Notably, automated trading infrastructure accounted for 95.80% of the standard transaction volume, with decentralized exchange bots driving over 99,000 separate calls.

Because smart contract conditions, account nonces, and liquidity depths will revert to August 11 parameters, previous interactions cannot simply be re-submitted without unpredictable outcomes.

Outside cybersecurity auditors have independently verified the fund-flow mapping, while core contributors continue coordinating with exchange partners, bridge operators, and law enforcement agencies to navigate the post-restart environment.