While cryptocurrency hacks have become all too common, instances where attackers take significant risks only to gain relatively modest rewards are less frequent. One such unusual case occurred on Sunday, when an attacker exploited a vulnerability in Hyperbridge's cross-chain bridge, connecting different blockchains, to mint 1 billion Polkadot tokens on Ethereum and then sell them for approximately $237,000 in ether. This exploit highlights the growing number of vulnerabilities in bridge protocols, following a $270 million Drift Protocol exploit on Solana last month.
The attack targeted Hyperbridge's EthereumHost contract, specifically how it validates incoming cross-chain messages before passing them to the TokenGateway, rather than Polkadot's core network, which remained unaffected. The weakness in bridge architecture lies in their admin-level control over token contracts, making a single validation failure potentially disastrous.
The attacker submitted a forged message that bypassed validation checks, granting them admin rights to the bridged Polkadot token contract. They then minted 1 billion tokens and sold them through Odos Router V3 and Uniswap V4, but the low liquidity of the DOT-ETH pool limited their gains to roughly 108.2 ETH. The market's inability to absorb large orders at stable prices worked against the attacker, capping their profit. The bridged DOT pool's limited depth meant the attacker received only a fraction of a cent per token, a stark contrast to what could have been a significantly larger loss if the pool had greater depth or the asset was more valuable.
As of Monday morning, DOT was trading just under $1.20. CertiK identified the exploit, confirming the attacker profited around $237,000, while Hyperbridge has yet to comment on the incident or disclose whether other token contracts are vulnerable to similar attacks.