Attacker Exploits $1 Billion Worth of Polkadot Tokens, but Only Manages to Steal $250,000

While cryptocurrency hacks are not uncommon, instances where attackers take substantial risks only to reap relatively modest rewards are rare. Such a scenario unfolded recently. An attacker exploited a vulnerability in the Hyperbridge cross-chain gateway, which connects multiple blockchains, and managed to mint 1 billion Polkadot tokens, valued at $1.19 billion, on the Ethereum network. However, the attacker only managed to sell these tokens for approximately $237,000 worth of ether.

This exploit highlights the ongoing issue of bridge vulnerabilities in 2026, following a $270 million drain on the Drift Protocol on Solana last month. The recent exploit targeted the bridge contract, rather than Polkadot's core network, and the native token DOT remained unaffected. The vulnerability was found in the way Hyperbridge's EthereumHost contract validates incoming cross-chain messages before passing them to the TokenGateway.

Bridges, which facilitate the transfer of coins between different blockchains, are often the weakest link in cross-chain architecture due to their administrative control over token contracts on destination chains. A single validation failure can grant an attacker unlimited supply.

The attack involved the submission of a forged message via dispatchIncoming, which was routed to TokenGateway.onAccept. The request receipts check failed to verify the message against a valid cross-chain state commitment from Polkadot, allowing the gateway to process the message as legitimate. The accepted message executed changeAdmin on the bridged Polkadot token contract, transferring administrative rights to the attacker's address. With administrative control, the attacker minted 1 billion tokens and sold them through Odos Router V3 into a Uniswap V4 DOT-ETH pool, extracting roughly 108.2 ETH.

However, the limited liquidity in the bridged DOT pool on Ethereum meant that the attacker only received a fraction of a cent per token. The same vulnerability could have resulted in significantly larger losses if it had been exploited on a deeper pool or a higher-value bridged asset. The attack was flagged by CertiK, which confirmed that the attacker profited approximately $237,000 from the exploit.