Supply inflation as an attack vector

Harmony confirmed the unauthorized creation of approximately 4 billion ONE tokens.

The minted amount represented roughly 26% of total supply, effectively diluting every existing holder in a single transaction sequence.

The project suspended bridge operations and coordinated with exchanges to freeze associated addresses once the issue was identified.

The price impact was immediate

ONE fell sharply as the news spread, with declines reported between roughly 26% and 40% depending on the measurement window.

Analysis suggested that the overwhelming majority of the minted tokens had already reached exchanges or been sold before mitigation took effect, with estimates as high as 97%.

That timing is what turned a technical flaw into a realized loss for holders.

Why mint exploits are different

Most crypto attacks drain assets from a contract. Mint exploits create claims out of nothing.

The distinction matters because:

• there is no pool to refill or bridge to reimburse
• the loss is distributed across every holder through dilution
• the attacker's proceeds come from the open market
• freezing addresses does not undo the sold supply
• remediation usually requires a chain-level intervention

Recovery options narrow considerably once the tokens have been sold into liquidity.

Bridges under pressure again

The incident landed alongside a separate cross-chain failure, with the Coreum bridge reported to have lost close to 200,000 XRP in an attack lasting under two hours that exploited fraudulent deposit handling.

Bridges remain among the most consistently targeted components in the ecosystem, because they hold pooled assets and rely on accounting logic that must correctly reconcile state across independent chains.

A single incorrect assumption on either side of a bridge can be converted directly into supply.

Response options are all imperfect

Projects hit by mint exploits face a narrow set of choices.

The available paths typically include:

• a chain halt or rollback, which undermines credible neutrality
• a token migration with a snapshot of legitimate balances
• burning recovered tokens to restore approximate supply
• negotiating with the attacker for partial return
• accepting the dilution and rebuilding market confidence

Each option trades one form of damage for another, and none restores the original state cleanly.

What audits keep missing

Exploits of this type tend to originate in privileged functions rather than in complex financial logic.

The recurring weak points include access control on mint permissions, upgradeability keys, bridge validator sets, deposit verification and the assumption that off-chain components will always behave correctly.

Contract audits that focus on economic logic can pass while these operational surfaces remain exposed.

Why this matters

This matters because supply integrity is the foundational promise of any token, and an exploit that breaks it damages more than a treasury.

For an ecosystem still working to earn institutional trust, incidents that make token supply itself unreliable are among the most costly failures possible.

The clean takeaway

An exploit on Harmony resulted in the unauthorized minting of roughly 4 billion ONE tokens, about 26% of supply, with most of the proceeds reportedly sold before the bridge was suspended and exchange freezes took effect. The token fell sharply, and the incident highlights how mint and bridge vulnerabilities differ from ordinary asset theft.