Attacker Exploits Hyperbridge Vulnerability, Mints $1 Billion in Polkadot Tokens, but Only Nets $250,000

Cryptocurrency hacks have become all too familiar, but instances where attackers take substantial risks only to reap minimal rewards are relatively rare. Such a scenario unfolded on Sunday, as an attacker exploited a vulnerability in Hyperbridge's cross-chain gateway, which connects multiple blockchains, to mint 1 billion Polkadot tokens, valued at $1.19 billion, on the Ethereum network. The attacker then sold these tokens for roughly $237,000 worth of ether. This incident highlights the growing concern of bridge vulnerabilities in 2026, following a $270 million exploit on Solana's Drift Protocol last month.

The Sunday attack targeted Hyperbridge's EthereumHost contract, specifically the validation process for incoming cross-chain messages, which allowed the attacker to forge a message and gain admin control over the bridged DOT token contract. Bridges, designed to facilitate the transfer of coins between blockchains, remain a weak point in cross-chain architecture due to their admin-level control over token contracts on destination chains. A single validation failure can grant an attacker the ability to mint an unlimited supply of tokens. The attack began with the submission of a forged message via the dispatchIncoming function, which was then routed to TokenGateway.onAccept.

However, the request receipts check failed to verify the message against a valid cross-chain state commitment from Polkadot, allowing the gateway to process the message as legitimate. This resulted in the execution of the changeAdmin function on the bridged Polkadot token contract, transferring admin rights to the attacker's address. With this control, the attacker minted 1 billion tokens in a single transaction and sold them through Odos Router V3 into a Uniswap V4 DOT-ETH pool, extracting approximately 108.2 ETH.

The limited liquidity in the bridged DOT pool on Ethereum worked against the attacker, capping their profit. Had the attack occurred on a deeper pool or a higher-value bridged asset, the losses would have been significantly larger. As of Monday morning, DOT trades just under $1.20.

The exploit was flagged by CertiK, confirming the attack vector as the Hyperbridge gateway contract, with the attacker profiting around $237,000 from minting and selling the bridged tokens. Hyperbridge has yet to publicly comment on the exploit or disclose whether other bridged token contracts using the same gateway are vulnerable to similar attacks.