Harmony (ONE) Confirms Exploit After Attacker Mints 4 Billion Unauthorized Tokens
Harmony’s ONE token just went through the kind of hour every Layer 1 team dreads, and the aftermath is turning into a referendum on how the project handles a crisis for the second time.
Harmony confirmed an exploit in which an attacker used an “empty blocks” technique to mint roughly 4 billion unauthorized ONE tokens, nearly 26% of total supply, without triggering the network’s normal validation checks. ONE’s price crashed more than 50% within two hours as an estimated 2.8 billion of the minted tokens were funneled onto exchanges. Harmony is now weighing a chain rollback to undo the damage. Blockchain investigator ZachXBT publicly declined to assist with tracing the funds, citing how Harmony handled its 2022 Horizon Bridge hack.
The “empty blocks” method is notable because it does not rely on a stolen private key or a compromised bridge contract, the two most common Layer 1 attack vectors. Instead it appears to have exploited a gap in how the network validates block production itself, letting the attacker mint supply directly rather than draining an existing pool of funds.
A rollback would not be a small technical fix. Reversing chain history to erase an exploit is a decision with real precedent, most famously Ethereum’s 2016 response to the DAO hack, and it always reopens the same debate about immutability versus pragmatism. For a chain already carrying reputational weight from 2022, choosing to roll back invites comparisons either way: critics will call it an admission that Harmony’s security model cannot be trusted to stand on its own.
ZachXBT’s public refusal is arguably the more damaging development of the two. Investigators of his standing typically stay neutral on troubled projects; a named, on-record refusal to help, explicitly tied to Harmony’s past handling of a hack, signals a trust deficit that a patch alone cannot repair.
Want to understand how validators and block production are supposed to prevent exactly this kind of unauthorized minting? Learn more in the Bitcoin Academy.