While cryptocurrency hacks are not uncommon, instances where attackers take significant risks only to gain minimal rewards are rare. One such incident occurred on Sunday, where an attacker exploited a weakness in a cross-chain gateway to mint 1 billion Polkadot tokens, valued at $1.19 billion, on the Ethereum network, and then sold them for approximately $237,000 in ether. This incident highlights the ongoing issue of bridge vulnerabilities, which have been a recurring problem in 2026, including a recent $270 million exploit on Solana.
The attack targeted the bridge contract, rather than Polkadot's core network, and was made possible by a flaw in the validation process for cross-chain messages. The vulnerability allowed the attacker to submit a forged message, which was then accepted as legitimate, granting them administrative control over the bridged token contract. With this control, the attacker was able to mint 1 billion tokens and sell them on a Uniswap pool, but due to limited liquidity, they were only able to extract a relatively small amount of ether. The incident serves as a reminder of the risks associated with cross-chain architecture and the importance of robust security measures to prevent such attacks.
The attack was flagged by CertiK, which confirmed the exploit and the attacker's profits. Hyperbridge has yet to comment on the incident or disclose whether other token contracts using the same gateway are vulnerable to similar attacks.