Harmony ONE Exploit Rollback: Is Your ONE Safe?

The attacker found a way to mint new ONE through empty blocks — blocks that should have produced no new supply — and the chain's totalSupply endpoint didn't immediately reflect the inflation, which delayed detection. By the time Harmony's team caught it, the bulk of the minted tokens were already routed off-chain. Harmony has since shipped a validator patch, v2026.1.1, to close the minting vector, paused the Horizon bridge, and is asking exchanges to freeze four wallet groups tied to the exploit. The attacker still appears to hold a small remainder of the mint on-chain — under 3% of the 4 billion, by Harmony's own accounting — and whether that gets frozen before it moves is one of the few open variables left in this story.

Harmony says it is "evaluating" a full chain rollback, which would mean rewriting recent blockchain history to erase the unauthorized mint — technically possible on a network Harmony's validators still control, but a step few chains ever take because it undermines the immutability a blockchain is supposed to guarantee. The precedent here matters: Harmony's only comparable crisis, the 2022 Horizon bridge hack that cost roughly $100 million, was never resolved with a rollback. The chain kept running as-is, and losses were absorbed rather than reversed. Nothing in Harmony's current messaging suggests this time is different in kind, only that the option is on the table. Markets should treat a rollback as possible but unproven until validators actually coordinate one and exchanges agree to honor it — an outcome that requires broad cooperation Harmony hasn't secured in a comparable crisis before.

Adding to the credibility gap: blockchain investigator ZachXBT has publicly said he won't help trace the exploit funds this time, citing being uncompensated after volunteering to help track the 2022 bridge-hack proceeds. That's a signal worth taking seriously — independent researchers are often the ones who actually locate stolen or minted funds moving through exchanges and mixers, and losing that volunteer capacity makes any recovery effort slower and less likely to succeed, rollback or not.

For most holders, the answer is dilution and mark-to-market loss, not direct theft. The exploit didn't drain existing wallets or exchange custody balances — it created new tokens out of thin air and sold them, which crushes the value of every ONE token already in circulation, including whatever you're holding on an exchange. That's a real loss, but it's a different mechanism than a hack that empties your account. The exception is if an exchange you use hasn't yet frozen the attacker-linked wallets Harmony flagged and those wallets still have a path to dump the remaining unminted-but-attacker-held supply — in that scenario, further price damage is still possible even though your specific balance was never directly touched.

Even a successful patch and a hypothetical rollback don't automatically restore the ~3.9 billion tokens that already left the ecosystem through exchange sales. A rollback would need to reverse transactions across every wallet and exchange that touched the minted supply, including sales to buyers who had no idea the tokens were illegitimate — a coordination problem far larger than the 2022 bridge hack, where recovery efforts focused on tracing and freezing funds rather than rewriting settled trades. Realistically, the more likely outcome is that Harmony stops further minting (already done via the patch), asks exchanges to freeze what they can, and otherwise lets the market absorb the diluted supply. That leaves ONE's price near these debased levels for the foreseeable future, since the token now has meaningfully more supply chasing the same demand, with none of the usual technical support levels intact — this is the lowest ONE has ever traded, so there's no prior floor to lean on.

Three things will tell you whether this stabilizes or gets worse. First, whether major exchanges confirm they've actually frozen the flagged wallets, rather than just being asked to — Harmony's request and an exchange's compliance are two different things, and the gap between them is where the remaining attacker-held ONE could still exit. Second, whether Harmony discloses the technical root cause of the empty-block minting bug; silence here would suggest the team isn't fully confident the vector is closed, which matters for anyone weighing whether to hold through the patch. Third, watch for any movement of the roughly 115 million ONE the attacker appears to still control on-chain — if that moves to exchanges, expect another leg down. Absent a genuine rollback, which history suggests is unlikely, ONE's path forward is a slow grind against a supply base that just grew by a quarter overnight.