Cryptocurrency hacks have become increasingly common, but instances where attackers go to great lengths only to walk away with relatively modest sums are rare. Such a scenario unfolded on a recent Sunday, where an attacker targeted a vulnerability in Hyperbridge's cross-chain gateway, successfully minting 1 billion Polkadot tokens on the Ethereum blockchain, valued at $1.19 billion, and subsequently selling them for around $237,000 in ether. This exploit highlights the ongoing issue of bridge vulnerabilities in 2026, following a $270 million Drift Protocol incident on Solana and a social engineering attack that compromised infrastructure.
The attack did not compromise Polkadot's core network or its native token, DOT. Instead, it targeted the bridge contract, exploiting a weakness in how Hyperbridge's EthereumHost contract validates incoming cross-chain messages before passing them to the TokenGateway. Bridges, designed to facilitate the transfer of coins between different blockchains, remain a weak point in cross-chain architecture due to their administrative control over token contracts on destination chains.
A single validation failure can grant an attacker unlimited supply. The attack began with the submission of a forged message via dispatchIncoming, which was then routed to TokenGateway.onAccept.
However, the request receipts check, intended to verify the message against a valid cross-chain state commitment from Polkadot, failed to do so, suggesting either the absence or circumvention of proof validation for this specific call path, leading the gateway to process the message as legitimate. The accepted message then executed changeAdmin on the bridged Polkadot token contract, transferring administrative rights to the attacker's address. With administrative control, the attacker was able to mint 1 billion tokens in a single transaction and sell them through Odos Router V3 into a Uniswap V4 DOT-ETH pool, extracting approximately 108.2 ETH across multiple swaps at slightly different prices. The limited liquidity of the bridged DOT pool on Ethereum worked against the attacker, significantly capping their profit.
Typically, weak liquidity is a challenge for large investors, but in this case, it prevented the attacker from realizing the full potential of their exploit. The bridged DOT pool's shallow depth meant that the 1 billion tokens overwhelmed the available liquidity, resulting in the attacker receiving only a fraction of a cent per token.
On a deeper pool or with a higher-value bridged asset, the same vulnerability could have led to substantially larger losses. As of the Asian morning hours on Monday, DOT was trading just under $1.20. The exploit was flagged by CertiK, confirming that the attack vector was indeed the Hyperbridge gateway contract and that the attacker profited approximately $237,000 from minting and selling the bridged tokens. Hyperbridge has yet to publicly comment on the exploit or disclose whether other bridged token contracts using the same gateway are vulnerable to the same type of forged-message attack vector.