Harmony says it plans to restart its blockchain from two checkpoints recorded late on Aug. 11 UTC as part of a recovery effort tied to a forged mint of ONE. The proposal would erase all blocks produced after those points, removing the affected chain history but also discarding more than 109,000 regular transactions and 315 staking transactions created during the period.
Under the plan described in the network’s latest incident update, validators would keep shard 0 block 92,730,034 and shard 1 block 94,978,278, both timestamped 11:25:37 p.m. UTC on Aug. 11. New production would then resume from shard 0 block 92,730,035 and shard 1 block 94,978,279 using replacement databases and a client update designed to reject the abnormal block hashes connected to the incident.
Why Harmony chose those checkpoints
Harmony said the first confirmed forged mint reached shard 0 at block 92,730,036. The immediately prior block, 92,730,035, contained no regular transactions, no staking transactions, no incoming receipts and no gas usage, while leaving state unchanged from block 92,730,034.
That allowed the team to choose block 92,730,034 as the retained checkpoint while keeping a one-block safety buffer before the first confirmed forged mint. For shard 1, Harmony included a checkpoint at the matching timestamp as a precaution and said the associated databases, scripts and validator procedures had already been prepared and reviewed around that state.
Replacement databases instead of an in-place rewind
The network said it does not intend to rely on its existing rewind function. According to Harmony, that mechanism mainly moves chain heads backward and does not completely remove later receipts, indexes, snapshots and cross-shard data, which could leave an attack path open or cause validators to rebuild different states after restart.
Using a replacement database, by contrast, is meant to give validators one reviewed starting point for consensus. Harmony added that client version v2026.1.2 has been configured to reject the abnormal block hashes linked to the event so validators do not accept the affected history once the chain resumes.
The team said it also considered other approaches and rejected them. A blacklist would leave the forged supply in circulation while potentially affecting wallets that hold legitimate assets. Selective transaction replay was ruled out because transactions replayed on a different state could have different outcomes, and a token migration was judged to be even more disruptive.
Scale of the rollback and traced fund flows
If carried out, the rollback would remove every block after the selected checkpoints. Harmony said its shard 0 archive for blocks 92,730,035 through 92,871,662 contains 141,628 blocks, 109,126 regular transactions and 315 staking transactions, with 109,441 exact transaction-to-receipt matches.
The project cautioned that the transaction count should not be treated as a count of affected users. It said 95.80% of regular transactions were automated, with a large share tied to decentralized exchange activity. Even simple native transfers may not be safe to replay because they depend on the replaced state, while all staking transactions depend on chain and epoch conditions that would change after restart.
Investigators also described how forged ONE spread through the ecosystem. A wallet linked to the forged mint executed 534 transfers of 5 billion ONE in 106 seconds, with 477 successful transfers moving 2.385 trillion ONE. Harmony said the activity reached standalone wallets, exchange accounts, DEX routers and pools, liquidity provider positions, bridge contracts, wrapped ONE and staking wallets.
What remains unresolved
Harmony said tracing becomes harder once forged ONE mixes with other assets. Its model caps the amount attributed to forged tokens at each wallet’s available balance to avoid double-counting, and the team said route coverage does not identify every individual behind each destination because funds may sit in shared exchange or service accounts.
That also limits what can be safely destroyed. Some tokens may be separable, Harmony said, but others may be held in pooled accounts where removing them could affect unrelated assets. The project said it is working with exchanges, bridges and law enforcement to preserve records and continue the investigation.
An independent third-party security company reviewed the incident and, according to Harmony, confirmed the forged mint and the main fund-flow findings. The next stated task for the project is to determine how to handle affected parties and assess the impact of throwing out post-checkpoint activity, including ordinary transactions that had no connection to the forged mint.
Source: crypto.news