Cryptocurrency hacks have become all too common, but it's rare for attackers to take huge risks and walk away with relatively small gains. However, that's exactly what happened on Sunday when an attacker exploited a vulnerability in a cross-chain gateway.
The attacker was able to mint 1 billion Polkadot tokens, valued at $1.19 billion, on the Ethereum network, but only managed to sell them for approximately $237,000 worth of ether. This exploit highlights the ongoing issue of bridge vulnerabilities, which have been a weak point in cross-chain architecture.
In this case, the vulnerability was found in the validation process for incoming cross-chain messages, allowing the attacker to forge a message and gain administrative control over the bridged token contract. The attacker was then able to mint a large amount of tokens and sell them on the market, but the limited liquidity of the bridged DOT pool on Ethereum meant that they were only able to realize a fraction of the potential value.
The exploit has been flagged by CertiK, and it's unclear whether other bridged token contracts using the same gateway are vulnerable to the same attack vector.