Attacker Exploits Cross-Chain Vulnerability, Mints $1 Billion in Polkadot Tokens, but Only Nets $250,000

While cryptocurrency hacks are becoming increasingly common, instances where attackers take significant risks only to reap relatively modest rewards are rare. One such incident occurred on Sunday, where an attacker exploited a weakness in Hyperbridge's cross-chain gateway, connecting multiple blockchains, to mint 1 billion Polkadot tokens, valued at $1.19 billion, on the Ethereum network, and subsequently sold them for approximately $237,000 in ether.

This exploit highlights the growing list of vulnerabilities in bridge protocols, following a $270 million exploit on the Drift Protocol on Solana last month. The attack targeted the bridge contract, rather than Polkadot's core network, and the native DOT token remained unaffected. The vulnerability lay in the validation process of incoming cross-chain messages by Hyperbridge's EthereumHost contract before passing them to the TokenGateway.

Bridges, which facilitate the transfer of coins between different blockchains, are often the weakest link in cross-chain architecture due to their administrative control over token contracts on destination chains. A single validation failure can grant an attacker unlimited minting capabilities.

The attack unfolded with the submission of a forged message via dispatchIncoming, which was routed to TokenGateway.onAccept. The request receipts check failed to verify the message against a valid cross-chain state commitment from Polkadot, allowing the gateway to process the message as legitimate. The accepted message transferred administrative rights to the attacker's address, enabling them to mint 1 billion tokens and sell them through Odos Router V3 into a Uniswap V4 DOT-ETH pool, netting around 108.2 ETH. However, the limited liquidity in the bridged DOT pool on Ethereum worked against the attacker, capping their profit.

The same vulnerability could have resulted in significantly larger losses if the pool had greater depth or if the bridged asset had a higher value. As of Monday morning, DOT was trading just below $1.20. CertiK identified the exploit, confirming the attack vector was the Hyperbridge gateway contract, and the attacker's profit was approximately $237,000 from minting and selling the bridged tokens.

Hyperbridge has not publicly commented on the exploit or disclosed whether other bridged token contracts using the same gateway are vulnerable to the same attack vector.