Cryptocurrency hacks have become all too common, but it's rare for attackers to take huge risks and end up with relatively modest gains. However, that's exactly what happened on Sunday when an attacker exploited a vulnerability in Hyperbridge's cross-chain gateway, which connects different blockchains. The attacker managed to mint 1 billion Polkadot tokens, valued at $1.19 billion, on the Ethereum network, but only sold them for approximately $237,000 worth of ether.
This exploit highlights the ongoing issue of bridge vulnerabilities, which have been a weak point in cross-chain architecture. In this case, the attacker targeted the bridge contract, not Polkadot's core network, and the native DOT token was unaffected.
The vulnerability lay in how Hyperbridge's EthereumHost contract validated incoming cross-chain messages before passing them to the TokenGateway. Bridges are designed to facilitate the transfer of coins between different blockchains, but they often hold admin-level control over token contracts on destination chains, making them a prime target for attackers.
If an attacker can bypass validation checks, they can potentially mint an unlimited supply of tokens. The attack began when the attacker submitted a forged message via dispatchIncoming, which was then routed to TokenGateway.onAccept.
However, the request receipts check failed to verify the message against a valid cross-chain state commitment from Polkadot, and the gateway processed the message as legitimate. This allowed the attacker to execute a changeAdmin function on the bridged Polkadot token contract, transferring admin rights to their address.
With admin control, the attacker was able to mint 1 billion tokens in a single transaction and sell them on the market. However, due to the limited liquidity in the bridged DOT pool on Ethereum, the attacker was only able to extract roughly 108.2 ETH, worth approximately $237,000, across multiple swaps. This highlights the importance of liquidity in the market, as it can either work for or against attackers. In this case, it capped the attacker's profits.
The bridged DOT pool on Ethereum had limited depth, meaning the 1 billion tokens overwhelmed the available liquidity, and the attacker received only a fraction of a cent per token. If the same vulnerability had been exploited on a deeper pool or a higher-value bridged asset, the losses could have been significantly larger.
According to CertiK, the attack vector was indeed the Hyperbridge gateway contract, and the attacker profited approximately $237,000 from minting and selling the bridged tokens. Hyperbridge has yet to publicly comment on the exploit or disclose whether other bridged token contracts using the same gateway are vulnerable to the same forged-message attack vector.