Cryptocurrency hacks have become commonplace, but instances where attackers take significant risks only to reap minimal rewards are rare. One such incident occurred on Sunday, where an attacker exploited a vulnerability in a cross-chain gateway, resulting in the minting of 1 billion Polkadot tokens, valued at $1.19 billion, on the Ethereum network, only to exchange them for approximately $237,000 in ether. This incident is the latest in a series of bridge vulnerabilities exposed in 2026, including a $270 million exploit on Solana's Drift Protocol last month.
The Sunday attack targeted the bridge contract, specifically the EthereumHost contract's validation process for incoming cross-chain messages, which was found to be deficient. As a result, the attacker was able to submit a forged message, granting them admin control over the bridged Polkadot token contract. The native DOT token, however, remained unaffected.
The weakness of bridges in cross-chain architecture lies in their admin-level control over token contracts, making them vulnerable to attacks. In this case, the attacker's gains were limited due to weak liquidity in the market, which prevented them from selling the tokens at a higher price. According to on-chain data, the attacker submitted a forged message, which was processed as legitimate due to a lack of proper validation. The message granted the attacker admin rights, allowing them to mint 1 billion tokens and sell them on Uniswap, resulting in roughly 108.2 ETH.
The incident highlights the importance of robust validation mechanisms in cross-chain transactions. CertiK, a security firm, confirmed the attack vector and estimated the attacker's profit to be around $237,000.
Hyperbridge has yet to comment on the incident or disclose whether other token contracts using the same gateway are vulnerable to similar attacks.