The team behind the Harmony blockchain project has made a radical decision — a full network rollback to the state before the exploit, which allowed attackers to unauthorizedly generate about 4 trillion ONE tokens. This is one of the largest incidents of supply forgery in the industry's history, and recovery will require complex technical manipulations.
Key checkpoints for recovery
The developers chose a single recovery point for both shards to minimize discrepancies and protect legitimate assets. Checkpoints are set at block #92,730,034 for Shard 0 and block #94,978,278 for Shard 1. Both blocks correspond to August 11, 2026, 23:25:37 UTC. After the rollback, the network will continue operating from subsequent blocks, and all data after these heights will be discarded.
Why burning and blacklists didn't work
Alternative scenarios, such as targeted burning or adding addresses to blacklists, were rejected due to high risks. The fake tokens have already passed through exchanges, DEXs, liquidity pools, and bridges, mixing with legitimate funds. Destroying the entire traceable volume is impossible without losing other people's assets. A blacklist, in turn, does not solve the supply issue and could block innocent wallets. Selective transaction recovery was also deemed dangerous: after changing the blockchain's state, the same operations could yield unpredictable results, especially for swaps and staking.
Technical details of the attack
The root cause was a vulnerability in the cross-shard transaction confirmation mechanism, allowing already-used receipts to be reprocessed. Additionally, an issue was identified with quorum verification for epoch committees: under certain conditions, a zero BLS signature passed validation. The Harmony team has already shared lists of addresses linked to the incident with exchanges and LayerZero, and is also cooperating with law enforcement agencies.
Scale of consequences
Analysis of 141,628 consecutive Shard 0 blocks showed: 109,126 regular and 315 staking transactions, of which 99,863 were DEX operations. Only 22 operations were simple transfers without dependencies, but even their recovery was deemed unsafe. After the rollback, balances, pool reserves, and staking states will change, making selective recovery extremely risky. The network remains in recovery mode, and the final launch depends on the consent of validators and exchanges.
My analysis: This incident highlights a fundamental security problem in cross-shard communications within multichain architectures. Harmony's decision to roll back is a forced but logical step, yet it sets a dangerous precedent: users lose access to legitimate transactions, and trust in the network is undermined. Investors should reconsider the risks of holding funds on projects with such vulnerabilities.