Hacker Exploits Polkadot Token Bridge, Makes Off with $250,000 Despite Minting $1 Billion

Cryptocurrency hacks are a common occurrence, but instances where attackers take significant risks only to reap relatively small rewards are rare. One such incident occurred on Sunday, where an attacker exploited a vulnerability in the Hyperbridge cross-chain gateway to mint 1 billion Polkadot tokens, valued at $1.19 billion, on the Ethereum network, and then sold them for approximately $237,000 in ether. This exploit highlights the ongoing issue of bridge vulnerabilities in 2026, following a $270 million hack on Solana's Drift Protocol last month. The attack targeted the bridge contract, specifically the EthereumHost contract's validation process for incoming cross-chain messages, rather than Polkadot's core network, leaving the native DOT token unaffected.

Bridges, which facilitate the transfer of coins between different blockchains, are often the most vulnerable part of cross-chain architecture due to their administrative control over token contracts on destination chains, making them a prime target for attackers. The exploit began when the attacker submitted a forged message via the dispatchIncoming function, which was then routed to the TokenGateway.onAccept function. However, the request receipts check, intended to verify the message against a valid cross-chain state commitment from Polkadot, failed to do so, allowing the gateway to process the message as legitimate. This enabled the attacker to execute a changeAdmin function on the bridged Polkadot token contract, granting them administrative rights, and subsequently mint 1 billion tokens in a single transaction.

The attacker then used the Odos Router V3 to transfer the tokens to a Uniswap V4 DOT-ETH pool, from which they extracted around 108.2 ETH across multiple swaps. Notably, the limited liquidity in the bridged DOT pool on Ethereum worked against the attacker, as the large volume of tokens overwhelmed the available liquidity, resulting in the attacker receiving only a fraction of a cent per token. Had the vulnerability been exploited on a deeper pool or a higher-value bridged asset, the losses could have been significantly greater. The incident was flagged by CertiK, which confirmed that the attack vector was the Hyperbridge gateway contract and that the attacker profited approximately $237,000 from minting and selling the bridged tokens.

Hyperbridge has yet to publicly comment on the exploit or disclose whether other bridged token contracts using the same gateway are vulnerable to similar attacks.