Attacker Mints About 4 Billion Harmony ONE Tokens, Sending the Token Down 26 Percent

An attacker created roughly 4 billion new ONE tokens on the Harmony blockchain, and the token fell 26 percent as the new supply hit the market, CoinDesk reported early Wednesday. Harmony said during Asian morning hours that it is coordinating with exchanges to freeze the proceeds and is preparing a software fix.

Harmony has not published a root-cause analysis, and the mint remains an allegation rather than a confirmed reconstruction of events. What can be stated is the failure class. An unauthorized mint means the network's supply rule, the property that makes a token's issuance schedule credible, did not hold. Every other risk in a token, including custody and liquidity, depends on that assumption holding. Unauthorized-mint failures usually trace to one of two sources: a contract or module whose minting permission is reachable by an address that should not hold it, or a client-level accounting defect that lets the chain credit balances it never actually debited.

The network has been here before. In June 2022 an attacker drained about $100 million from Harmony's Horizon bridge after compromising the multisignature keys that authorized withdrawals, a theft United States officials later attributed to operators linked to North Korea. Harmony's proposed remedy at the time, minting up to 4.97 billion ONE to repay victims, was abandoned after community opposition. In December 2023 a separate defect erroneously minted roughly 150 million ONE, worth about $2.2 million, to 79 wallets.

Freezing is the immediate test. Exchanges can seize deposited tokens, so how much the attacker actually recovers depends on how fast the proceeds reached centralized venues rather than decentralized pools. Rekt News, which catalogues on-chain losses, continues to list open case files across smaller protocols, and Harmony's incident adds to an already elevated 2026 loss total.