Direct answer: Harmony is preparing a rollback of its blockchain to an August 11, 2026 checkpoint after an attacker exploited weaknesses in cross-shard receipt validation and pre-staking quorum verification. Harmony’s later reconstruction says one wallet successfully transferred 2.385 trillion forged ONE tokens in 477 transactions over 106 seconds. The rollback plan targets Shard 0 block 92,730,034 and Shard 1 block 94,978,278, but a published plan is not the same as confirmed execution. For traders, the key risks are supply-accounting confidence, exchange exposure to forged tokens, and the operational cost of discarding legitimate post-checkpoint history.

Key takeaways

• Harmony’s August 12 incident involved unauthorized ONE issuance through verification failures, not a conventional private-key theft alone.
• GitHub pull request #5101, merged on August 12, documents fixes for both the replay path and the quorum-calculation flaw.
• Harmony’s August 17 plan would rebuild the chain from August 11 at 23:25:37 UTC, before the reported forged activity.
• Bitcoin.com reported that more than 109,000 regular transactions and 315 staking transactions would be discarded on the affected Shard 0 rollback window.
• Public reporting contains multiple issuance figures; the most specific later reconstruction cited by Harmony and reported by Bitcoin.com is 2.385 trillion successful transfers, while a broader 3.0100001 trillion reconstruction remains part of the accounting discussion.
• ONE price volatility can persist even after the technical exploit is patched because rollback execution, exchange reconciliation, liquidity, and user confidence remain separate risks.

Visual credit: Original LiveVolatile editorial diagram based on Harmony incident updates as reported by Bitcoin.com, Harmony’s merged GitHub PR #5101, and Rekt’s technical incident reconstruction. It is an explanatory graphic, not a price forecast.

What happened to Harmony’s ONE supply?

The incident began when an attacker found a way to make the network accept cross-shard receipts without the corresponding source-side debit. In a cross-shard system, a receipt is supposed to prove that value was committed on one shard before it is credited on another. If the same receipt can be presented as new, the destination can credit value that was never newly spent.

Harmony’s merged GitHub pull request #5101 describes the relevant replay fix. Before the fix, the spent-marker key for older receipts could rely on ShardID and BlockNum fields from a Merkle proof that were not sufficiently bound to the signed source-block header. A manipulated proof identity could therefore make a previously applied receipt resolve to a different “unspent” key.

The same pull request documents a separate quorum issue. The verifier compared the full committee size rather than counting only the validators enabled in the signer bitmap for a pre-staking-era path. The patch changed that calculation, rejected a nil mask, and added regression tests.

These are implementation details, but they explain why the incident is different from ordinary exchange theft. The problem was not merely that an attacker moved existing ONE. The network’s validation logic could credit new ONE without a matching debit. That creates a monetary-accounting problem: markets must decide which balances and transfers represent valid state after the exploit.

How large was the unauthorized issuance?

The numbers require careful wording because they changed as investigators reconstructed the flow.

Bitcoin.com reported on August 17 that Harmony’s technical update identified one wallet attempting 534 fraudulent transfers of 5 billion ONE each in a 106-second window. 477 transfers succeeded, producing and moving 2.385 trillion ONE. The same report said early estimates had focused on an initial four-billion-ONE wave.

The independent Rekt incident reconstruction records a broader Harmony accounting figure of 3,010,000,100,000 ONE across six forged cross-shard transactions into four exploiter wallets, while separately describing the later 2.385 trillion transfer reconstruction. Those figures should not be casually collapsed into one number: one may describe a broader issuance model, while the other describes a specific wallet’s successful transfer sequence.

For volatility analysis, the distinction matters less than the underlying failure: the market temporarily lacked a trustworthy answer to “how much valid ONE exists, and which balances survive?” A price chart can show a crash, but it cannot resolve the state-accounting question.

What Harmony’s rollback plan does

Harmony’s reported plan is a fixed-window rollback, not a selective reversal of only the attacker’s transactions. The team proposed retaining:

Bitcoin.com reported that the Shard 0 window contained 141,628 consecutive blocks, including 109,126 regular user transactions and 315 staking transactions, that would be permanently discarded under the plan. The loss of transaction history is the cost of restoring a pre-incident state without trying to identify and remove every contaminated balance individually.

That trade-off creates a second trust problem. A rollback can remove forged issuance, but it can also erase legitimate transfers, deposits, withdrawals, and staking activity that occurred after the checkpoint. Users and exchanges must reconcile their off-chain records with the rebuilt chain. A technically successful rollback can therefore still produce operational disputes.

The most important status distinction is simple:

• Plan announced: Harmony has specified checkpoints and a restart method.
• Validator coordination: Operators must adopt the replacement databases and compatible software.
• Rollback executed: The rebuilt chain is producing blocks and services are restored.
• Economic reconciliation: Exchanges, bridges, and users have confirmed balances and deposits.

Those are separate milestones. Do not label the network “fixed” merely because the rollback plan exists.

Why the patch does not end the volatility

Harmony released a patch to stop further unauthorized minting and paused bridge services while exchanges were asked to freeze related addresses. The merged security fix is evidence that the two code paths were addressed in the main repository. It is not, by itself, proof that every validator, exchange, bridge, indexer, or wallet has completed operational recovery.

1. Supply confidence can remain impaired

If market participants disagree about the valid supply or the treatment of contaminated balances, liquidity providers may widen spreads and reduce inventory. That can make relatively small orders move ONE sharply in either direction.

2. Exchange exposure can create discontinuous moves

Forged ONE routed toward centralized exchanges may be frozen, rejected, reversed, or stranded during reconciliation. Each venue can have a different operational timeline. A reopening announcement may create a burst of volume, while a new freeze or deposit restriction can produce another abrupt repricing.

3. Rollback risk is a market-structure event

A chain halt or reorganization affects more than token holders. It can interrupt bridge flows, staking operations, market-maker transfers, and price feeds. Traders should watch whether derivatives venues reference a functioning spot market or continue quoting during a fragmented recovery.

4. Confidence damage can outlast the code fix

Rekt described this as Harmony’s third major security failure in four years, following the 2022 bridge theft and a 2023 staking bug. Historical failures do not prove a future exploit, but they can affect how quickly validators, exchanges, developers, and liquidity providers return.

A practical ONE volatility checklist

Use the event as a monitoring framework rather than a directional prediction:

1. Official status: Has Harmony confirmed that the rollback was executed, or is the update still describing preparation?
2. Validator health: Are both shards producing blocks consistently, with no further emergency pauses?
3. Exchange operations: Which venues have resumed deposits and withdrawals, and under what reconciliation rules?
4. Bridge status: Are cross-chain services open, and are their balances synchronized with the rebuilt state?
5. Spot liquidity: Are spreads, order-book depth, and volume normalizing across multiple venues?
6. Derivatives positioning: Are open interest, funding, basis, and liquidations amplifying a thin spot move?
7. Supply evidence: Do explorers and official endpoints agree on total supply and circulating balances after the restart?

The LiveVolatile market monitor, liquidations dashboard, and ONE volatility search can help organize the market side of this checklist. They do not replace Harmony’s incident updates, exchange notices, or on-chain verification.

Three scenarios traders should model

Clean recovery: Validators complete the restart, explorers agree on the rebuilt state, exchanges reconcile balances, and liquidity returns. In this case, volatility may shift from exploit panic to recovery speculation—but a recovery rally still requires spot confirmation.

Operationally messy recovery: The rollback technically completes, but deposits, withdrawals, bridges, or price feeds remain restricted. ONE can continue to gap because market access is fragmented and participants cannot move inventory normally.

Confidence failure: The chain experiences another pause, the final issuance accounting changes materially, or exchanges disagree about affected balances. This would keep the security discount elevated and could create renewed forced selling.

FAQ

Did Harmony permanently roll back the network?

The available reporting confirms that Harmony announced a rollback plan with specific checkpoints. It does not establish from the sources reviewed that the rollback was fully executed and economically reconciled. Treat execution as a separate status that requires a later official confirmation.

How many ONE tokens were forged?

Harmony’s later reconstruction, reported by Bitcoin.com, identified 2.385 trillion ONE moved through 477 successful transfers from one wallet. Rekt also records a broader 3.0100001 trillion issuance reconstruction. The figures describe different stages or scopes of the accounting and should not be presented as interchangeable without qualification.

What vulnerability enabled the exploit?

GitHub PR #5101 describes a cross-shard receipt replay issue involving an unauthenticated Merkle-proof identity and a separate pre-staking quorum-calculation flaw. The fixes bind the spent marker to signed header data and count enabled signer bits correctly.

Does a rollback guarantee that ONE will recover?

No. It can remove a contaminated state, but price also depends on exchange access, liquidity, user confidence, validator participation, and broader market conditions.

What should traders verify before trading ONE?

Verify the official rollback status, current total supply, block production on both shards, exchange deposit and withdrawal rules, bridge status, spot liquidity, and derivatives leverage. Avoid relying on a single social-media post or a stale price feed.

Conclusion

Harmony’s ONE crisis is a useful case study in why crypto security events become volatility events. The exploit was rooted in verification and accounting logic: the network accepted value credits that were not backed by a corresponding debit. Once forged tokens reached market infrastructure, the problem expanded from code to exchanges, bridges, validators, explorers, and every holder relying on a stable supply record.

The rollback plan may restore a pre-incident state, but the market still needs evidence of execution and reconciliation. Until official updates show that the rebuilt chain is stable and trading venues agree on balances, the most defensible stance is to treat ONE as a high-risk recovery market—not a normal altcoin dip.

Risk disclaimer: This article is for informational and educational purposes only. Crypto assets are volatile and can lose some or all of their value. Security incidents, rollback plans, market data, and protocol timelines can change quickly. Nothing here is financial, legal, or investment advice.

Sources and visual credits

1. Harmony GitHub PR #5101: Cx receipt fixes main — primary technical record for the merged replay and quorum-verification fixes; merged August 12, 2026.
2. Harmony Protocol to Roll Back Network After Massive Exploit — Bitcoin.com, August 17, 2026; rollback checkpoints, transaction-discard estimate, and 2.385 trillion transfer reconstruction.
3. Harmony — Rekt — Rekt, August 18, 2026; technical incident reconstruction, broader issuance accounting, and exploit chronology.
4. Visual credit: /images/articles/harmony-one-rollback-volatility-map-2026-08-19.svg is an original LiveVolatile editorial diagram created for this article. It uses no third-party image.

— Marcus Reynolds, Senior Crypto Volatility Analyst