Hacker Exploits Cross-Chain Vulnerability, Steals $250,000 from Polkadot Token Bridge

Cryptocurrency hacks have become increasingly common, but it's rare for attackers to take significant risks and end up with relatively modest gains. However, this was the case in a recent incident that occurred on Sunday. An attacker exploited a vulnerability in Hyperbridge's cross-chain gateway, which connects different blockchain networks, and minted 1 billion Polkadot tokens ($1.19 billion) on the Ethereum network.

The attacker then sold these tokens for around $237,000 worth of ether. This exploit highlights the growing list of vulnerabilities in bridge protocols, which are used to transfer assets between different blockchain networks.

Last month, a $270 million exploit occurred on the Solana network, and a social engineering attack also involved compromised infrastructure. The recent exploit targeted the bridge contract, not the core Polkadot network, and the native DOT token was not affected.

The vulnerability was found in the way Hyperbridge's EthereumHost contract validated incoming cross-chain messages before passing them to the TokenGateway. Bridges are often the weakest link in cross-chain architecture because they have admin-level control over token contracts on destination chains, making them a prime target for attackers. The attack unfolded when the attacker submitted a forged message via dispatchIncoming, which was routed to TokenGateway.onAccept.

The request receipts check failed to verify the message against a valid cross-chain state commitment from Polkadot, allowing the attacker to gain admin rights to the bridged Polkadot token contract. With admin control, the attacker minted 1 billion tokens in a single transaction and sold them through Odos Router V3 into a Uniswap V4 DOT-ETH pool, extracting around 108.2 ETH.

The limited liquidity in the bridged DOT pool on Ethereum worked against the attacker, capping their profit. If the attack had occurred on a deeper pool or a higher-value bridged asset, the losses would have been significantly larger.

The incident was flagged by CertiK, which confirmed that the attack vector was the Hyperbridge gateway contract and that the attacker profited approximately $237,000 from minting and selling the bridged tokens. Hyperbridge has not publicly commented on the exploit or disclosed whether other bridged token contracts using the same gateway are vulnerable to the same attack vector.