Harmony Protocol developers say the network will be rolled back to an Aug. 11 checkpoint after an exploit allowed an attacker to mint and move 2.385 trillion ONE tokens. The planned reset affects Shard 0 and Shard 1 and would restore the chain to its state at 23:25:37 UTC on Aug. 11, before the breach occurred.
The team said the rollback will place Shard 0 at block height 92,730,034 and Shard 1 at 94,978,278. In practical terms, that means blocks and transactions processed after those checkpoints will be discarded so the network can resume from a pre-exploit state.
Exploit began on Aug. 12
According to the project, the incident started on Aug. 12 when flaws in cross-shard receipt validation and quorum verification code made token forgery possible. The attacker attempted 534 fraudulent transfers of 5 billion ONE each and succeeded in 477 of them.
Harmony said those successful transactions led to the unauthorized creation and transfer of 2.385 trillion ONE. The project also linked the event to a sharp market reaction, saying the token's price fell by more than 30% as forged coins were sent to exchanges.
Emergency response and tracing effort
Following the breach, Harmony deployed an emergency software update, Mainnet v2026.1.1, intended to stop any further token creation through the same path. The team also suspended cross-chain bridge services and asked exchanges to freeze addresses associated with the exploit.
Developers said they reviewed possible responses before choosing a fixed-window rollback. In their assessment, that approach was the safest way to avoid harm to unrelated funds and reduce the risk of long-term inconsistencies in the chain's state.
Harmony added that more than 99.9% of forged token flows have been traced, with support from an independent security firm. It also said law enforcement, bridge providers, and partner exchanges are involved in the effort to recover assets.
What the rollback will remove
Under the plan, validators are expected to adopt new databases built from the designated checkpoints and then regenerate blocks from that point onward. The rollback specifically targets the period between the selected Aug. 11 state and the later network pause.
The project said 141,628 consecutive blocks on Shard 0 will be discarded. It also expects the reset to remove 109,126 regular user transactions and 315 staking transactions that were recorded after the rollback point.
Next confirmed step
The next step outlined by the developers is for validators to switch to the checkpoint databases for Shard 0 and Shard 1 and rebuild the chain forward from there. If carried out as described, the network state would be returned to the moment before the exploit, while recovery efforts tied to exchanges, bridges, and law enforcement continue in parallel.
For now, the confirmed facts remain limited to the exploit timeline, the scale of unauthorized minting, the emergency patch, the bridge suspension, and the rollback parameters published by the team.
Source: news.bitcoin.com