While cryptocurrency hacks are not uncommon, instances where attackers take significant risks only to gain minimal rewards are rare. Such a scenario occurred on Sunday when an attacker exploited a vulnerability in a cross-chain gateway connecting different blockchains.
The attacker successfully minted 1 billion Polkadot tokens, valued at $1.19 billion, on the Ethereum network and subsequently sold them for roughly $237,000 in ether. This exploit highlights the growing list of bridge vulnerabilities in 2026, including a recent $270 million Drift Protocol incident on Solana. The targeted bridge contract, not Polkadot's core network, was the weak point, with the native DOT token remaining unaffected.
The vulnerability stemmed from how the Hyperbridge EthereumHost contract validated incoming cross-chain messages before passing them to the TokenGateway, allowing the attacker to submit a forged message that granted admin-level control over the bridged token contract. This control enabled the attacker to mint an unlimited supply of tokens. The attack unfolded with the submission of a forged message via dispatchIncoming, which was routed to TokenGateway.onAccept without proper validation.
The attacker then executed a changeAdmin function, transferring admin rights to their address, and minted 1 billion tokens. These tokens were then routed through Odos Router V3 into a Uniswap V4 DOT-ETH pool, from which the attacker extracted approximately 108.2 ETH.
The limited liquidity in the bridged DOT pool on Ethereum worked against the attacker, capping their profit to a fraction of the potential gain. If the exploit had occurred on a deeper pool or a higher-value bridged asset, the losses could have been significantly larger. The incident was flagged by CertiK, confirming the attack vector and the attacker's profit of approximately $237,000.
Hyperbridge has not publicly commented on the exploit or disclosed whether other bridged token contracts are vulnerable to the same attack vector.