Attacker Exploits Hyperbridge Vulnerability, Steals $250,000 in Ethereum

Cryptocurrency hacks have become increasingly common, but cases where attackers take substantial risks and end up with relatively modest gains are rare. One such incident occurred on Sunday, where an attacker exploited a weakness in Hyperbridge's cross-chain gateway, connecting different blockchains, to mint 1 billion Polkadot tokens, valued at $1.19 billion, on the Ethereum network, and then sold them for around $237,000 in ether. This exploit highlights the growing list of vulnerabilities in cross-chain bridge protocols, following a $270 million Drift Protocol hack on Solana last month.

The attack targeted Hyperbridge's EthereumHost contract, specifically the validation process for incoming cross-chain messages, which allowed the attacker to forge a message and gain admin control over the bridged DOT token contract. As a result, the attacker was able to mint 1 billion tokens and sell them on the market, albeit at a significantly lower price than expected due to low liquidity. The incident underscores the importance of robust security measures in cross-chain architecture, particularly in bridge protocols, which often hold admin-level control over token contracts on destination chains.

According to on-chain data, the attacker submitted a forged message via dispatchIncoming, which was routed to TokenGateway.onAccept, bypassing the request receipts check that should have verified the message against a valid cross-chain state commitment from Polkadot. The accepted message then executed changeAdmin on the bridged Polkadot token contract, transferring admin rights to the attacker's address, allowing them to mint the tokens and sell them on Uniswap.

The low liquidity in the DOT-ETH pool on Uniswap worked against the attacker, limiting their profits to approximately $237,000. The incident was flagged by CertiK, which confirmed the attack vector was the Hyperbridge gateway contract. Hyperbridge has yet to publicly comment on the exploit or disclose whether other bridged token contracts using the same gateway are vulnerable to similar attacks.