Attacker Exploits Polkadot Token Vulnerability on Ethereum, Nets Only $250,000

While cryptocurrency hacks are not uncommon, instances where attackers take significant risks only to gain minimal rewards are rare. One such instance occurred on Sunday, when an attacker exploited a vulnerability in Hyperbridge's cross-chain gateway, connecting various blockchains, to mint 1 billion Polkadot tokens, valued at $1.19 billion, on the Ethereum network, and subsequently sold them for approximately $237,000 in ether. This exploit highlights the growing list of bridge vulnerabilities in 2026, including a $270 million Drift Protocol incident on Solana last month.

The attack targeted Hyperbridge's EthereumHost contract, specifically the validation process for incoming cross-chain messages, which, when compromised, granted the attacker administrative control over the token contract on the destination chain. The native Polkadot token, DOT, remained unaffected, as the vulnerability was isolated to the bridge contract.

Bridges, facilitating the transfer of coins between blockchains, are often the weakest link in cross-chain architecture due to their administrative control over token contracts, making them susceptible to validation failures that can result in unlimited token minting. The attack unfolded when the perpetrator submitted a forged message, which, due to a lack of proper validation, was processed as legitimate, ultimately allowing the attacker to assume administrative rights and mint 1 billion tokens. These tokens were then routed through Odos Router V3 into a Uniswap V4 DOT-ETH pool, from which the attacker extracted roughly 108.2 ETH.

However, the limited liquidity in the bridged DOT pool on Ethereum significantly capped the attacker's profits, as the large volume of tokens overwhelmed the available liquidity, resulting in the attacker receiving only a fraction of a cent per token. This incident underscores the importance of robust security measures, especially in cross-chain architecture, to prevent such exploits. The vulnerability was flagged by CertiK, confirming the attack vector and estimated profits of approximately $237,000.