Harmony ONE Crashes 40%: Patch Landed Five Hours After the Mint

An attacker minted 4 billion ONE, around 26% of supply. Harmony shipped a patch five hours later, by which point 97% of the tokens had reached exchanges.

Harmony ONE Crashes 40%: Patch Landed Five Hours After the Mint

An attacker minted roughly 4 billion ONE tokens on Harmony early Wednesday, an amount equal to about a quarter of the supply. Harmony paused its bridge, named four wallets and pushed an emergency patch. By the time that patch reached validators, on-chain data showed about 97% of the new tokens had already reached exchanges.

A quarter of the supply, created through empty blocks

On-chain analyst Juiceberg flagged the mint early on 12 August, putting it at close to 4 billion ONE and saying the tokens had been produced through empty blocks. Roughly 15 billion ONE existed beforehand, so the mint added about 26% to the supply in a single session.

ONE fell around 40% to about $0.00077 and traded as low as $0.00057 during the day, a record low, while volume jumped more than 4,000% against the previous session. Harmony has confirmed the exploit but has not disclosed the vulnerability or verified the four-billion figure itself. Reference: CoinDesk (https://www.coindesk.com/markets/2026/08/12/harmony-s-one-falls-26-after-attacker-allegedly-mints-4-billion-tokens)

The drop stood out against an otherwise flat session. Bitcoin held near $64,000 on the same day after US inflation landed at 3.4% for July, matching forecasts, leaving Harmony as one of the few sharp movers on the board. That $64,000 area has been the market's pivot all summer. our website: DeyThere, "Why Is Bitcoin's $64K Support So Important Right Now?" (https://deythere.com/why-is-bitcoins-64k-support-so-important-right-now/)

The response worked. It just arrived late

Harmony's first statement said it was working with exchanges to stop and freeze funds. A follow-up named four wallets, listed in both Harmony and hex formats, and asked exchanges to block anything traced to them. Just over two hours later the project paused its bridge, and released a patch a minute after that, instructing validators to upgrade to a build it said blocks any further minting.

Five hours had passed between the analyst's first post and that patch. In that window roughly 2.8 billion ONE was routed to exchanges as the price collapsed, and Juiceberg later put the balance still sitting on-chain at about 115 million, or 2.9% of everything minted. A freeze request reaches funds that have not moved yet, and almost none of this had stayed still.

Reference: Decrypt (https://decrypt.co/375390/harmonys-one-sinks-37-after-attacker-mints-4-billion-tokens)
Exchanges are the only real choke point once tokens leave a wallet, because that is where they get turned into something an attacker can keep. A freeze can hold a deposit still sitting in custody. It cannot undo a trade that has already cleared. That is why the timing of the request counts for more than its wording.

A rollback would take honest transactions with it

Harmony says it is weighing a rollback, which would return the network to a state before the exploit and continue from there. That erases everything recorded afterwards, including transactions made by users who had nothing to do with the attack. The longer the chain runs before any decision, the more ordinary activity a rollback would destroy, and the tokens themselves have largely left the network already.

It is also not a call Harmony makes on its own. Rewriting settled history needs validators to run the build that does it, which turns a security fix into a governance vote.

The supply figures being quoted are already out of date

One detail complicates every number in circulation. Juiceberg pointed out that Harmony's totalSupply endpoint did not register the new tokens, and price trackers were still showing circulating supply near 14.87 billion hours after the mint. Any market capitalisation figure published for ONE today therefore rests on a supply count that predates the attack.

What to watch next

Three things decide how this lands. How much exchanges actually managed to freeze, whether Harmony commits to a rollback or writes the tokens off, and whether the project publishes the vulnerability. That last point carries weight because this is not the first time: Harmony lost about $100 million in a bridge hack in 2022, and a staking bug in 2023 improperly created 146.3 million ONE.

Note: This is a developing story and the figures above reflect on-chain estimates and project statements as of 12 August 2026. Harmony has not confirmed the total minted or disclosed the vulnerability. Nothing here is investment advice.

Marcus Kapinski
160 City Road, London, EC1V 2NX
contact@deythere.com

Deythere is a news platform covering cryptocurrency, finance, and business, providing timely market updates, analysis, and industry insights to a global audience focused on digital assets.

This release was published on openPR.