Worked example · 2026-08

Harmony — a committee verifier that counted the roster instead of the signers accepted an all-zero signature mask, and unauthenticated receipt-proof fields let spent cross-shard receipts be credited again — Harmony Mainnet (ONE) — 2026-08-12

Loss: Two figures, and the gap between them is the point. Nominal supply created: reporting escalated from ~4 billion ONE (~26% of a ~15 billion supply) in the first on-chain claim, to ~30.1 billion ONE (~$234M nominal) in later exchange-desk reporting, to ~3 trillion ONE (~$2.34B nominal) in CertiK Alert / BlockWatchdog monitoring of total anomalous mints. Realised proceeds were far smaller: SlowMist logs ~$3.2M for the incident, consistent with ~2.8 billion ONE reaching exchanges with roughly 97% sold or sitting in deposit wallets to sell. ONE fell from ~$0.00118–0.00124 to a low near $0.00056, about ‑38% in 24 hours. Harmony never published its own quantification — it quoted the analyst estimate without independently verifying it, so every mint figure here is third-party. This entry documents a live incident and its figures will age.
OAK Techniques observed: OAK-T10.002 (Message-Verification Bypass — primary, confirmed mechanism, and a shard-boundary rather than bridge-boundary instance of the class. Two defects, both patched in Harmony Mainnet v2026.1.1. First, the pre-staking-epoch committee verifier compared the size of the full committee against the quorum threshold instead of counting the validators actually enabled in the signer bitmap — so a message carrying an all-zero bitmap and a nil BLS aggregate signature satisfied quorum while representing no signatures at all. Second, cross-shard receipts marked as spent using proof fields that were never authenticated against the signed block header. See techniques/T10.002-message-verification-bypass.md). OAK-T10.003 (Cross-Chain Replay — the second defect's exploitation path: a genuine receipt that had already been applied could be resubmitted with altered proof identifiers and appear unspent again, crediting the destination shard with no corresponding debit at the source. Replay across shards of one chain rather than across chains, but structurally identical: the authorisation artefact was not bound to anything that made reuse detectable. See techniques/T10.003-cross-chain-replay.md). OAK-T7.002 (CEX Deposit Layering — the offramp: ~2.8B ONE moved to exchange deposit addresses and sold into whatever bid existed). Two neighbours explicitly do not apply. OAK-T10.001 (Validator / Signer Key Compromise) does not hold — no key was stolen; the verifier accepted a message that nobody signed, which is the opposite failure. OAK-T5.003 (Hidden-Mint Dilution) does not hold — there was no mint authority in a token contract to exercise; the supply was conjured by consensus-layer accounting crediting a destination without a source debit.
Attribution: pseudonymous. No named individual or group, and no link to a tracked OAK actor. Harmony published four wallet addresses and asked exchanges to block and freeze against them. Detection is attributed to independent on-chain analyst Juiceberg, with corroborating monitoring from CertiK Alert and BlockWatchdog — not to Harmony's own telemetry.
Key teaching point: A quorum check that counts the roster instead of the signatures is not a weak control — it is no control, and it will pass on an empty input. The verifier asked "is the committee large enough?" when the only question that matters is "did enough of them sign this?". An all-zero bitmap with a nil aggregate signature is the degenerate input that separates those two questions, and it sailed through. The second defect is the same disease in the replay dimension: a spent-marker derived from fields the signer never covered is a marker the attacker can rewrite, so "already spent" became a suggestion. Both fixes are one-line-shaped in description and structural in consequence — count enabled entries and reject empty masks; derive spent markers from the signed header — and both belong to the same rule: every value a verifier relies on must be inside the thing that was signed. The wider lesson is about which side of the supply invariant your monitoring sits on. Harmony's exposure was not exotic; total supply is the single most observable property a chain has, and a 26%-and-climbing increase in it was found by an outside analyst on Twitter rather than by the protocol. Any chain that mints on message receipt should treat supply delta per epoch as a first-class alarm with a hard bound, because that alarm is mechanism-independent: it fires whether the cause is a quorum bug, a replay, a bridge, or something nobody has named yet.

Summary

Harmony is a sharded proof-of-stake Layer-1. Assets moving between its shards are credited by cross-shard receipts — records asserting that value left one shard and should be created on another — and those receipts are authorised by a validator committee whose approval is expressed as an aggregate BLS signature plus a bitmap identifying which committee members signed.

Two verification defects sat in that path. The quorum verifier for pre-staking-epoch committees compared the full committee size against the quorum threshold rather than counting the validators enabled in the signer bitmap. A receipt presented with an all-zero bitmap and a nil BLS signature therefore passed the threshold test while carrying no approvals whatsoever. Separately, for receipts from older epochs, the marker recording that a receipt had already been spent was computed from proof fields that were not authenticated against the signed block header — so an already-applied receipt could be resubmitted with changed proof identifiers, appear unspent, and credit the destination again with no corresponding source debit.

On 2026-08-12, both were exercised against Harmony Mainnet. Newly created ONE entered circulation in a way that did not surface as an ordinary transfer or contract call — reporting described the mints as passing through otherwise-empty blocks — which is why the first public signal came from an analyst reconciling supply rather than from a transaction anyone was watching. On-chain analyst Juiceberg flagged roughly 4 billion ONE, about 26% of supply; Harmony confirmed an exploit hours later while explicitly not verifying any figure of its own. Later reporting put the total materially higher — ~30.1 billion ONE by one exchange desk, and ~3 trillion ONE in CertiK Alert and BlockWatchdog monitoring of total anomalous mints.

Harmony deployed Mainnet v2026.1.1 at 06:30 UTC (14:30 UTC+8) on 2026-08-12, patching both defects: quorum verification now counts enabled bitmap entries and rejects empty masks, and spent markers are now derived from signed headers. The team paused the bridge, published four addresses for exchange blocking, and began preparing a rollback to block 92,730,034. Roughly 2.8 billion ONE had already reached exchanges, with about 97% sold or held in deposit wallets — which is precisely what makes the rollback question hard, because unwinding chain state does not unwind trades that settled off it. ONE fell about 38% in 24 hours.

Timeline (UTC)

When	Event	OAK ref
(standing)	Pre-staking-epoch committee verifier compares full committee size to the quorum threshold instead of counting validators enabled in the signer bitmap	(standing T10.002 surface)
(standing)	Cross-shard receipt spent-markers derive from proof fields not authenticated against the signed block header	(standing T10.003 surface)
2026-08-12 (pre-dawn)	Unauthorised ONE minted on mainnet; supply enters circulation without presenting as ordinary transfers, reported as passing through otherwise-empty blocks	T10.002 → T10.003
2026-08-12	On-chain analyst Juiceberg flags ~4B ONE (~26% of supply) minted; CertiK Alert and BlockWatchdog corroborate anomalous minting at far larger totals	M39 (external watcher)
2026-08-12 06:30	Harmony deploys Mainnet v2026.1.1: quorum verification counts enabled bitmap entries and rejects empty masks; spent markers derived from signed headers	M12 (patched)
2026-08-12	Bridge paused; four attacker addresses published for exchange blocking and freezing	M34, M41
2026-08-12	~2.8B ONE reaches exchanges, ~97% sold or in deposit wallets awaiting sale; ONE falls ~38% to a low near $0.00056	T7.002
2026-08-12 onward	Harmony confirms the exploit while quoting rather than verifying the analyst mint estimate; rollback to block 92,730,034 in preparation, terms unannounced	(operator response)
ongoing	No Harmony quantification of total unauthorised supply; no published accounting of what exchanges froze	(open)

What defenders observed

Pre-event (the verifier answered the wrong question). "Is the committee big enough?" and "did enough of the committee sign this message?" are different questions, and a bitmap-based scheme makes the difference concrete: the answer must come from counting set bits, not from the length of the roster. Any signature-mask verifier should be tested against the degenerate inputs specifically — empty mask, nil aggregate, single-bit mask — because those are the cases where roster-counting and signer-counting diverge (M16).
Pre-event (spent-markers must live inside the signature). A replay guard computed over fields the signer never committed to is attacker-writable by construction. Binding the spent-marker to the signed header is the same rule that closes cross-chain replay generally: the uniqueness key must be part of the authenticated payload (M12).
At-event (supply is the invariant, and it was not being watched). The most detectable property of the incident was the total supply of the native token. The protocol did not raise the alarm; an independent analyst did, and monitoring firms confirmed it afterwards. A hard per-epoch supply-delta bound is mechanism-independent and would have fired on the first wave regardless of which of the two defects produced it (M11).
At-event (a mint that does not look like a transfer defeats transfer-shaped monitoring). Reporting describes the new supply entering through otherwise-empty blocks — no ordinary transfer, no contract call. Detection tooling keyed to transaction patterns sees nothing; only balance-and-supply reconciliation does. This is the reusable signature for consensus-layer minting defects.
Response (the offramp beat the patch). The patch landed the same day, but ~2.8B ONE was already at exchanges and ~97% of it sold or staged to sell. Freeze coordination is the only lever left at that point, and its effectiveness went unreported (M41).
Response (rollback is a governance problem wearing a technical costume). Rolling back to block 92,730,034 would unwind chain state that users, bridges, and exchanges have already treated as final, while doing nothing about proceeds realised off-chain. Harmony left both the rollback decision and its validity guarantees unspecified — which is itself the observation: a chain that mints on message receipt should decide its rollback doctrine before it needs one.

Public references

[thedefiantharmony2026] — The Defiant, "Harmony Patches Pre-Staking Quorum and Receipt-Replay Flaws After ONE Mint Claim" (the primary technical account: the pre-staking-epoch committee verifier comparing full committee size against threshold rather than counting validators enabled in the signer bitmap, the all-zero bitmap with nil BLS signature passing validation, the unauthenticated receipt proof fields allowing resubmission with altered identifiers and re-crediting with no source debit, the v2026.1.1 fixes, and the explicit separation of what Harmony confirmed from what remained an analyst claim): https://thedefiant.io/news/hacks/harmony-patches-pre-staking-quorum-and-receipt-replay-flaws-after-one-mint-claim
[cryptoslateharmony2026] — CryptoSlate, "Harmony weighs a full blockchain rollback after unauthorized minting floods exchanges with billions in ONE" (independent description of both receipt flaws, the ~4B ONE and ~2.8B-to-exchanges estimates, the four published addresses, and the rollback deliberation): https://cryptoslate.com/harmony-weighs-a-full-blockchain-rollback-after-unauthorized-minting-floods-exchanges-with-billions-in-one/
[theblockharmony2026] — The Block, "Harmony confirms exploit involving unauthorized minting of 4 billion ONE tokens" (Harmony's confirmation, the ~$3.2M realised valuation of the initially-reported mint, ~97% of tokens reaching exchanges, and the absence of a disclosed root cause at confirmation time): https://www.theblock.co/news/defi/2026-08-12-harmony-confirms-exploit-one-token-411527
[coindeskharmony2026] — CoinDesk, "Harmony's ONE falls 40% after attacker allegedly mints 4 billion tokens" (market impact and the deliberately hedged framing of the mint figure): https://www.coindesk.com/markets/2026/08/12/harmony-s-one-falls-26-after-attacker-allegedly-mints-4-billion-tokens
[coingapeharmony2026] — CoinGape, "ONE Token Crashes 40% as Harmony Protocol Confirms Unauthorized 4B Mint Exploit" (detection by Juiceberg, the price path from $0.00124 to $0.000535, the bridge pause, and Harmony's exchange-freeze statement): https://coingape.com/one-token-crashes-harmony-protocol-confirms-unauthorized-mint-exploit/
[kucoinharmony2026] — KuCoin News flash, "Harmony Suffers Major Security Breach, 30 Billion ONE Tokens Illegally Minted" (the escalating figures — an initial ~4B/40B range revised upward, and CertiK Alert / BlockWatchdog monitoring reporting ~3 trillion ONE anomalously minted at ~$2.34B nominal — plus the four published addresses and the unresolved rollback question): https://www.kucoin.com/news/flash/harmony-suffers-major-security-breach-30-billion-one-tokens-illegally-minted
[slowmistzoneharmony2026] — SlowMist Hacked (zone entry, 2026-08-11, Harmony Protocol, $3,200,000, "Protocol Logic Vulnerability") — the realised-loss datapoint against the much larger nominal mint: https://hacked.slowmist.io/

Discussion

Harmony is the cleanest anchor OAK has for the proposition that T10.002 is not a bridge Technique, it is a message-verification Technique — and shards are just another boundary across which messages carry authority. Every structural feature of the canonical bridge cases is present: a committee, an aggregate signature, a proof, a destination that mints on receipt. The only thing missing is a second chain. Contributors should map shard-boundary, rollup-to-L1, and app-chain-to-hub failures into the T10.x family on mechanism rather than reserving it for things marketed as bridges.

The pairing of the two defects also deserves attention, because either alone is bad and together they compose. The quorum bug means an attacker does not need any validator to cooperate; the replay bug means an attacker does not need a new receipt. One supplies authorisation from nothing, the other supplies unlimited reuse of something real. A defender enumerating this surface should ask both questions separately of every verifier they own — who actually signed, and what stops this from being applied twice — because they fail independently and audits that check one routinely skip the other.

Finally, the incident is a case study in reporting uncertainty as a first-class fact. Public figures for the unauthorised supply span three orders of magnitude, from 4 billion to 3 trillion ONE, while the realised proceeds sit around $3.2M — because minting 3 trillion units of a token does not create $2.34B of anything; it creates a number that the order book will not honour. OAK records the nominal and realised figures separately and attributes each, rather than picking a headline. Harmony's own silence on quantification is part of the record too: a chain that cannot say how much of its native token exists after an incident is telling defenders something important about its instrumentation, and the honest way to preserve that is to write down that the number is missing rather than to inherit someone else's estimate as fact.