Attacker Exploits Hyperbridge Vulnerability, Mints $1 Billion in Polkadot Tokens, but Only Profits $250,000

Cryptocurrency hacks are a common occurrence, but it's rare for attackers to take significant risks and walk away with relatively small gains. However, this unusual scenario unfolded on Sunday when an attacker exploited a vulnerability in Hyperbridge's cross-chain gateway, connecting various blockchains, to mint 1 billion Polkadot tokens, valued at $1.19 billion, on the Ethereum network, and subsequently sold them for around $237,000 in ether.

This incident highlights the growing list of bridge vulnerabilities in 2026, following a $270 million Drift Protocol exploit on Solana last month, and a social engineering attack that compromised infrastructure. The exploit targeted the bridge contract, not Polkadot's core network, leaving the native DOT token unaffected. The vulnerability stemmed from the validation process of incoming cross-chain messages in Hyperbridge's EthereumHost contract, which, when bypassed, granted the attacker admin-level control over the token contract on the destination chain.

Bridges, which facilitate the transfer of coins between blockchains, are often the weakest link in cross-chain architecture due to their admin-level control over token contracts, making them vulnerable to single validation failures that can grant an attacker unlimited minting capabilities. The attack involved submitting a forged message via dispatchIncoming, which was routed to TokenGateway.onAccept, bypassing the request receipts check that should have verified the message against a valid cross-chain state commitment from Polkadot. With the message accepted as legitimate, the attacker gained admin rights to the bridged Polkadot token contract, minting 1 billion tokens in a single transaction and selling them through Odos Router V3 into a Uniswap V4 DOT-ETH pool, resulting in roughly 108.2 ETH. The limited liquidity in the bridged DOT pool on Ethereum worked against the attacker, capping their profit.

The exploit was flagged by CertiK, confirming the attack vector as the Hyperbridge gateway contract, with the attacker profiting approximately $237,000 from the minting and sale of the bridged tokens. Hyperbridge has yet to publicly comment on the exploit or disclose whether other bridged token contracts using the same gateway are vulnerable to the same attack vector.