Attacker Exploits Vulnerability, Mints $1 Billion in Polkadot Tokens on Ethereum, but Only Steals $250,000

While cryptocurrency hacks are commonplace, instances where attackers assume significant risk yet gain minimal rewards are rare. Such an unusual scenario unfolded on Sunday, as an attacker leveraged a vulnerability in Hyperbridge's cross-chain gateway, which connects various blockchains, to mint 1 billion Polkadot tokens, valued at $1.19 billion, on the Ethereum network, and subsequently sold them for roughly $237,000 in ether.

This exploit contributes to the growing list of bridge vulnerabilities in 2026, following a $270 million drain on Solana's Drift Protocol last month and a social engineering attack involving compromised infrastructure. The targeted bridge contract, rather than Polkadot's core network, was the point of vulnerability, with the native DOT token remaining unaffected. The issue lay in the validation process of incoming cross-chain messages by Hyperbridge's EthereumHost contract before passing them to the TokenGateway.

Bridges, which facilitate the transfer of coins between blockchains, remain a weak point in cross-chain architecture due to their administrative control over token contracts on destination chains. A single validation failure can grant an attacker unlimited supply.

The attack involved the submission of a forged message via dispatchIncoming, routed to TokenGateway.onAccept, which bypassed the request receipts check. This check should have verified the message against a valid cross-chain state commitment from Polkadot but instead stored an all-zeros commitment value, indicating either absent or circumventable proof validation.

The gateway processed the message as legitimate, executing changeAdmin on the bridged Polkadot token contract and transferring administrative rights to the attacker's address. With administrative control, the attacker minted 1 billion tokens in a single transaction and sold them through Odos Router V3 into a Uniswap V4 DOT-ETH pool, extracting approximately 108.2 ETH across multiple swaps. However, the limited liquidity in the bridged DOT pool on Ethereum worked against the attacker, capping their profit.

The pool's limited depth meant that the 1 billion tokens overwhelmed the available liquidity, resulting in the attacker receiving only a fraction of a cent per token. On a deeper pool or a higher-value bridged asset, the same vulnerability would have resulted in significantly larger losses. As of Monday morning, DOT trades just under $1.20. CertiK identified the exploit, confirming the attack vector as the Hyperbridge gateway contract and the attacker's profit as approximately $237,000 from minting and selling the bridged tokens.

Hyperbridge has not publicly commented on the exploit or disclosed whether other bridged token contracts using the same gateway are vulnerable to the same forged-message attack vector.