The Harmony blockchain project team has prepared to roll back the network to the state immediately before the exploit, as a result of which attackers were able to unlawfully release about four trillion ONE tokens. According to the developers, they have chosen a single recovery point for both shards to delete the assets generated by the fraudsters and minimize the risk of damaging legitimate user funds. To restore the network, control points were selected at the block height of ninety‑two million seven hundred and thirty thousand thirty‑four for the zero shard and ninety‑four million nine hundred and seventy‑eight thousand two hundred and seventy‑eight for the first shard. Both blocks correspond to August 11, 2026. It is at these heights that the validators will receive new databases, after which the network will continue to operate from the subsequent blocks.

Earlier, Harmony representatives reported that the incident began on August 12. The first attack was recorded on the zero shard. According to one reconstruction, the total volume of counterfeit emission amounted to about three trillion ONE through inter‑shard transactions, and according to an earlier analysis, the emission in empty blocks reached four trillion tokens, which is approximately twenty‑seven percent of the total number of coins in circulation. The team considered several alternatives to a rollback but abandoned them due to the high risk of affecting ordinary users’ funds. Targeted burning turned out to be too dangerous, as the tokens issued by the fraudsters had time to pass through exchanges, decentralized platforms, liquidity pools, and bridges. After mixing counterfeit ONE with legitimate funds, it is impossible to safely destroy the entire tracked volume without risking the loss of others’ assets. A blacklist of addresses was also not suitable, as it does not eliminate the already created emission and may block unrelated wallets. Selective transaction recovery was deemed too risky due to changes in the state of smart contracts. Therefore, Harmony decided to apply a single rule: all blocks after the selected checkpoints will be discarded.

The root cause of the attack was a vulnerability in the mechanism for confirming inter‑shard transactions, which allowed already‑used receipts to be reprocessed. Additionally, the developers identified a problem with the quorum verification for staking committees. Preliminary analysis made it possible to trace more than ninety‑nine and nine‑tenths percent of the fake tokens, but successful monitoring does not provide a way to safely destroy the illegitimate coins. The team has already submitted lists of addresses related to the incident to exchanges and law enforcement agencies. The rollback will affect tens of thousands of transactions: in the zero shard alone, more than one hundred and forty‑one thousand blocks containing over one hundred and nine thousand regular operations were analyzed. Currently, the network remains in recovery mode, and the final launch depends on the agreement of validators and trading platforms.