The Layer-1 blockchain has identified block 92,730,034, recorded on August 11 at 23:25:37 UTC, as the proposed point to which the network would be restored. Harmony is coordinating with validators and exchanges on the rollback approach after deploying fixes designed to prevent the vulnerability from being exploited again.
The incident was initially associated with the unauthorised creation of about 4 billion ONE tokens, equivalent to roughly 26% of the network’s previously reported supply of about 15 billion. Harmony subsequently confirmed that two empty-block transactions generated 1 billion and 3 billion ONE respectively.
Investigators have also been reconstructing a broader series of suspicious transactions, leaving the final scale of the attack subject to reconciliation. The network’s response has therefore moved beyond simply preventing additional minting towards determining which blockchain state should be treated as valid.
Harmony paused Shard 0 at block 92,753,555 while preparing the rollback operation. The interruption has also affected official remote procedure call infrastructure, with some endpoints becoming temporarily unavailable as developers work on restoring a consistent ledger.
The investigation identified weaknesses involving cross-shard receipt replay and quorum verification. Cross-shard receipts record activity moving between separate portions of Harmony’s blockchain. A failure to ensure that already processed receipts could not be executed again allowed the attacker to trigger illegitimate token creation.
Developers have patched the cross-shard validation mechanism and introduced changes to precommittee quorum verification. Mainnet software version 2026.1.1 was deployed on August 12, with validators instructed to upgrade as quickly as possible. More than half of validators had adopted the emergency software within hours of its release.
Harmony also suspended its bridge service and began working with exchanges and interoperability providers to identify and freeze assets linked to attacker-controlled addresses. Billions of newly created ONE tokens had already moved away from the original wallets before containment measures could be fully implemented.
Early on-chain tracking indicated that about 2.8 billion ONE was transferred to additional addresses associated with the attacker, with substantial quantities reaching cryptocurrency exchanges. That movement complicates any blockchain rollback because transactions completed within centralised exchange systems cannot necessarily be reversed simply by rewriting Harmony’s ledger.
A rollback effectively instructs participating validators to discard blockchain history after a selected block and continue from an earlier state. Such interventions are uncommon because public blockchains are designed around the principle that confirmed transactions should remain permanent.
Harmony’s proposal therefore creates a difficult trade-off. Returning to the pre-exploit block could remove fraudulent on-chain activity and restore the token supply recorded before the attack. It could also invalidate legitimate transactions conducted after the rollback point, including transfers, decentralised finance operations and other activity unrelated to the exploit.
The controversy revives questions about how decentralised networks should respond when protocol-level flaws compromise their ledgers. Developers can choose to preserve existing history and introduce corrective transactions, or persuade validators to reorganise the chain and remove compromised blocks. Either option can affect users who acted while the network was still processing transactions normally.
ONE’s market value fell sharply after disclosure of the exploit, dropping by roughly 40% at one stage and reaching an all-time low near $0.00057 before recovering part of the decline. The sudden creation of billions of tokens raised fears of severe dilution and additional selling pressure if the unauthorised supply reached liquid markets.
Harmony has faced major security problems before. Its Horizon cross-chain bridge suffered a theft of about $100 million in June 2022, while a separate staking-related vulnerability discovered in 2023 resulted in approximately 146.3 million ONE being created improperly.
The latest breach differs because the vulnerability affected fundamental network validation and token creation rather than solely compromising assets held by a bridge. That distinction increases the significance of the rollback debate, since developers are attempting to establish a trustworthy version of the blockchain itself.
Validator participation will be critical to executing the proposed reversal. Harmony cannot simply alter distributed blockchain history through a conventional database command; operators securing the network must run compatible software and converge on the designated chain state.
Arabian Post – Crypto News Network
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
