Cryptocurrency hacks have become increasingly common, but instances where attackers take significant risks only to gain minimal rewards are rare. One such incident occurred on Sunday, where an attacker exploited a vulnerability in Hyperbridge's cross-chain gateway, connecting multiple blockchains, to mint 1 billion Polkadot tokens on Ethereum, valued at $1.19 billion, and exchange them for approximately $237,000 in ether. This exploit highlights the growing list of vulnerabilities in bridge architectures, including a recent $270 million Drift Protocol incident on Solana.
The attack targeted Hyperbridge's EthereumHost contract, specifically the validation process for incoming cross-chain messages, which failed to verify the message against a valid cross-chain state commitment from Polkadot. As a result, the attacker was able to submit a forged message, gaining admin control over the bridged Polkadot token contract and minting 1 billion tokens. The tokens were then routed through Odos Router V3 into a Uniswap V4 DOT-ETH pool, from which the attacker extracted roughly 108.2 ETH.
However, limited liquidity in the bridged DOT pool on Ethereum restricted the attacker's profit, as the large volume of tokens overwhelmed the available liquidity, resulting in a fraction of a cent per token. The attack was flagged by CertiK, which confirmed the exploit and estimated the attacker's profit at approximately $237,000.
Hyperbridge has yet to publicly comment on the incident or disclose whether other bridged token contracts using the same gateway are vulnerable to similar attacks.