Attacker Exploits Polkadot Token Vulnerability on Ethereum, Nets Only $250,000

Cryptocurrency hacks have become commonplace, but instances where attackers take significant risks only to reap minimal rewards are rare. One such incident occurred on Sunday, when an attacker exploited a vulnerability in Hyperbridge's cross-chain gateway, which connects various blockchains, to mint 1 billion Polkadot tokens on Ethereum, valued at $1.19 billion, and subsequently sold them for approximately $237,000 in ether.

This exploit highlights the growing list of vulnerabilities in bridge architecture, following a $270 million drain on Solana's Drift Protocol last month and a social engineering attack that compromised infrastructure. The Sunday attack targeted Hyperbridge's EthereumHost contract, specifically the validation process for incoming cross-chain messages, which allowed the attacker to gain admin control over the bridged DOT token contract.

The vulnerability of bridges, which facilitate the transfer of coins between blockchains, stems from their admin-level control over token contracts on destination chains, making them susceptible to validation failures that can grant attackers unlimited minting capabilities. The attack unfolded when the perpetrator submitted a forged message via dispatchIncoming, which was then routed to TokenGateway.onAccept, bypassing the request receipts check that should have verified the message against a valid cross-chain state commitment from Polkadot.

The accepted message granted the attacker admin rights to the bridged Polkadot token contract, enabling them to mint 1 billion tokens in a single transaction. The attacker then routed these tokens through Odos Router V3 into a Uniswap V4 DOT-ETH pool, extracting around 108.2 ETH across multiple swaps at varying prices. However, the limited liquidity in the bridged DOT pool on Ethereum worked against the attacker, capping their profit. If the vulnerability had been exploited on a deeper pool or a higher-value bridged asset, the losses would have been significantly greater.

As of Monday morning, DOT was trading just below $1.20. The exploit was flagged by CertiK, which confirmed the attack vector and the attacker's profit of approximately $237,000 from minting and selling the bridged tokens.

Hyperbridge has yet to publicly comment on the exploit or disclose whether other bridged token contracts using the same gateway are vulnerable to the same attack vector.