What happens when a blockchain discovers that someone just created trillions of its native tokens out of thin air? That is the uncomfortable question Harmony is answering right now. The team has put forward a recovery plan that would roll the chain back to two specific checkpoints from August 11, effectively erasing more than 109,000 regular transactions in the process. I have been watching these kinds of incidents for years, and this one feels especially raw because the forged tokens did not stay quietly in one wallet. They moved fast, mixed with legitimate funds, and now the whole network is stuck choosing between imperfect options.
Why Harmony Is Choosing a Full Chain Rollback
The decision did not come lightly. According to the latest updates from the network, validators would keep shard 0 block 92,730,034 and shard 1 block 94,978,278. Both were recorded at the same exact second on August 11. From those points the network would restart using entirely new replacement databases. New blocks would then start at the next height on each shard.
I find it interesting that the team deliberately left a one-block safety buffer. The first confirmed forged mint appeared at block 92,730,036. The block right before it contained no regular transactions, no staking activity, and no gas usage at all. State remained identical to the previous block. That empty block gave them a clean place to cut without having to argue about partial activity.
Client version v2026.1.2 has already been configured to reject the abnormal block hashes tied to the incident. Once validators restart from the new databases, those tainted hashes simply will not be accepted. It is a hard reset, not a gentle rewind.
Replacement Databases Instead of Simple Rewind
Harmony could have used its existing in-place revert function. The team looked at that option carefully and decided against it. The built-in tool mainly moves the chain heads forward or backward. It does not fully clear later receipts, indexes, snapshots, or the messy cross-shard information that piles up after an incident. Leaving any of that data behind could open an attack route or cause different validators to end up in slightly different states. Nobody wants that kind of quiet divergence.
A full replacement database gives every validator the same reviewed starting point. It is heavier work, but it removes the risk of leftover artifacts. In my view this is the more responsible path, even if it feels drastic from the outside.
Options That Were Considered and Rejected
The team did not jump straight to rollback. They examined several alternatives first.
- Burning or repairing the forged tokens directly at their current locations
- Creating a blacklist of addresses that received the new supply
- Selectively replaying only the clean transactions after the checkpoint
- Migrating the entire token to a new contract
Each of those paths ran into the same wall. The forged ONE had already passed through exchanges, decentralized exchange pools, contracts, bridge routes, and countless individual wallets. Removing tokens at specific destinations risked hitting legitimate funds that happened to sit in the same balance. A blacklist would leave the inflated supply in existence while potentially locking out innocent holders. Selective replay looked attractive on paper until the team realized the replacement chain would have a different state, so the same transaction could produce completely different results. Token migration would have caused even larger disruption.
I have seen similar debates play out on other chains. When the cost of precision becomes higher than the cost of a clean cut, the clean cut often wins. That seems to be what happened here.
The Scale of Transactions That Would Disappear
To understand the real impact, Harmony built a full archive of shard 0 covering blocks 92,730,035 through 92,871,662. That range contained 141,628 consecutive blocks, 109,126 regular transactions, and 315 staking transactions. Receipt matching was exact for 109,441 cases. Parent-hash continuity and receipt completeness were checked throughout.
Here is the part that changes how most people should read the numbers. Of those 109,126 regular transactions, 104,545 were classified as automated. That is roughly 95.8 percent. Decentralized exchange automation alone accounted for 99,863 of them, including 75,430 successful swaps and 11,804 failed bot attempts. The raw count of discarded transactions is not the same as the number of human users who will feel the pain.
Still, some ordinary activity will vanish. Only 22 transactions looked like simple native transfers with no obvious dependency. Another 860 native transfers raised questions about balances, funding sources, nonces, or later spending. A further 80,630 transactions depended on contract or blockchain state. Failed transactions, incident-linked activity, and movements involving exchanges or bridges made up the rest. All 315 staking transactions depend on chain and epoch state, so they cannot simply be replayed either.
Once the replacement chain starts, balances, nonces, token approvals, swap deadlines, liquidity pool reserves, and staking conditions will all be different. A transaction that previously failed could succeed. A swap that previously succeeded could fail or produce a different amount. Full EVM traces were not available through the RPC data used in the review, so internal contract transfers remain partly opaque.
How the Forged Tokens Actually Moved
One wallet connected to the forged mint tried to send 534 transfers of 5 billion ONE each inside a 106-second window. Of those attempts, 477 succeeded and moved 2.385 trillion ONE. That speed is almost hard to believe. Investigators built a time-ordered graph starting from every wallet associated with the mints. They separated signed transactions from successful transfers, failed attempts, and every later movement through other addresses.
The activity was checked against blocks, receipts, and balances up through shard 0 block 92,805,850. Funds reached standalone wallets, exchange accounts, decentralized exchange routers and pools, liquidity provider positions, bridge contracts, wrapped ONE, staking wallets, and high-volume service wallets. When forged tokens mixed with other assets, the tracing model followed transfers in chronological order and capped the attributed amount at each wallet’s available balance. The goal was to avoid counting the same tokens multiple times as they bounced around.
An earlier model traced more than 99.9 percent of the forged supply to a wallet or service boundary. A later version reconciled almost the entire amount across those boundaries and transaction fees at the chosen cutoff. Coverage of routes is not the same as knowing who controls every destination. Exchange accounts, pools, and service clusters often hold funds belonging to many different users at once.
That mixing is the real problem. Forged tokens left sitting quietly in a standalone wallet might still be isolatable. Tokens that entered an exchange wallet, a liquidity pool, a bridge, or a shared staking position can no longer be removed cleanly without risking unrelated assets. The amount that can be safely destroyed is therefore smaller than the total that was created.
Investigation Status and Outside Help
Harmony has made initial progress toward tracing the actor behind the mint. The network is working with exchanges, bridges, and law enforcement to preserve records and continue the investigation. An independent third-party security company reviewed the incident separately and confirmed both the forged mint itself and the main findings from the fund-flow analysis.
This is not the first major security event for the project. The Horizon Bridge incident years earlier resulted in a large loss after private keys controlling the bridge were compromised. The team worked with exchanges, law enforcement, and analytics firms at that time as well. Some of those recovered funds took months to surface. The current effort appears to follow a similar multi-party approach.
For the present recovery, the team is also talking with exchanges and bridges about the practical effects of discarding every block after the checkpoints. That includes regular transactions that had nothing to do with the forged mint. Handling affected parties fairly will require coordination beyond the pure technical rollback.
What This Means for Ordinary Users and Validators
If you sent a transaction after the chosen checkpoints, that transaction will simply never have happened on the restarted chain. Staking rewards, swap results, and any contract interactions that depended on the discarded state will need to be re-evaluated. Some people will find their balances restored to an earlier point. Others may discover that tokens they received from mixed sources are no longer present.
Validators face a different set of tasks. They must install the new client version, load the replacement databases, and restart consensus from the agreed heights. The procedures and recovery scripts have already been prepared and reviewed around the selected blocks. Changing the checkpoint at a late stage would risk validators working from mismatched targets, so the team locked in the current choice.
I keep coming back to the human side of these decisions. Automated bots made up the vast majority of the transaction count, which softens the user impact on paper. Yet every ordinary transfer that disappears still represents someone who thought the chain state was final. That feeling of finality is part of what makes blockchain useful in the first place. When a network has to break it, even for good reasons, trust takes a temporary hit.
Lessons From Similar Incidents Elsewhere
Other projects have faced comparable choices. One network that suffered an execution-layer exploit initially considered a full rollback and later shifted toward targeted token burns after participants raised concerns about legitimate activity. Another protocol that saw unauthorized minting through compromised bridge keys halted affected operations and coordinated with exchanges while investigators tracked the new supply. In each case the common thread was the same: once tokens leave the original attacker wallets and mix with normal activity, pure technical solutions become incomplete.
Harmony’s choice of replacement databases rather than partial fixes reflects that reality. It accepts short-term disruption in exchange for a single clean state that every validator can verify. Whether that trade-off proves correct will only become clear after the network has been running again for some time and after the investigation yields more concrete results.
The Broader Question of Chain Finality
Every rollback forces the industry to confront an uncomfortable tension. Blockchains are marketed as immutable. In practice, social consensus among validators, developers, and major stakeholders can still rewrite recent history when the alternative looks worse. That power exists. Using it wisely is the hard part.
In this instance the forged supply was large enough and the mixing was rapid enough that leaving the chain as it stood would have left a permanent inflation problem. Removing the tokens after they had already moved risked collateral damage to innocent holders. The middle path of selective repair was technically fragile. So the team chose the blunt instrument of a coordinated rewind.
I do not pretend this is a perfect solution. Perfect solutions rarely exist after a successful mint of this size. What matters now is execution. Validators need to restart cleanly. Exchanges and bridges need clear guidance on how to treat discarded activity. Users need transparent information about what balances will look like on the new chain. The investigation needs to continue without interruption.
Practical Steps Users Should Consider Right Now
Anyone holding ONE or interacting with Harmony-based applications should treat the coming days carefully.
- Review any transactions you sent after the August 11 checkpoints and assume they may not exist after the restart.
- Check whether any tokens you received came through routes that investigators have linked to the forged supply.
- Avoid complex contract interactions until the new chain is stable and client versions are confirmed.
- Watch official channels for the exact restart timing and any required client upgrades.
- Document your own balances and transaction history as of the checkpoint blocks in case questions arise later.
None of these steps eliminate uncertainty, but they reduce the chance of surprise once the network restarts.
Looking Ahead After the Restart
Once the replacement chain is live, attention will shift to two parallel tracks. The first is technical stability. Validators must reach consensus quickly and keep the new blocks producing without further incidents. The second is accountability. Exchanges, bridges, and law enforcement still hold pieces of the investigation. How much of the forged supply can eventually be isolated or recovered remains an open question.
The project has survived previous security events and continued operating. That history does not guarantee a smooth recovery this time, but it does show that coordinated response is possible. The difference now is the sheer volume of forged tokens and the speed at which they spread. Handling that volume without destroying legitimate activity is the real test.
Perhaps the most interesting aspect of this entire episode is how clearly it illustrates the limits of pure on-chain solutions. When tokens mix at the scale seen here, the clean mathematical tools of the protocol are no longer enough. Social coordination, off-chain investigation, and difficult trade-offs become unavoidable. Harmony has chosen one set of trade-offs. The coming weeks will show whether that choice restores confidence or creates new friction.
In the meantime the network prepares for a deliberate step backward so it can move forward again. The checkpoints are set. The databases are ready. The client rejects the tainted hashes. All that remains is the collective decision to start over from those two points in time and to live with the consequences of everything that will no longer exist after the cut.
That is the reality of a major forged mint on a live chain. The numbers are large. The movement was fast. The options were imperfect. And the recovery plan now on the table is the one the team believes gives the network the cleanest path back to normal operation. Whether users and validators agree will become visible once the new blocks begin.
