Cryptocurrency hacks are commonplace, but instances where attackers take significant risks only to gain minimal rewards are rare. Such a scenario unfolded on Sunday, when an attacker leveraged a vulnerability in Hyperbridge's cross-chain gateway to mint 1 billion Polkadot tokens, valued at $1.19 billion, on the Ethereum network, and subsequently sold them for roughly $237,000 in ether. This exploit highlights the growing list of bridge vulnerabilities in 2026, including a $270 million Drift Protocol incident on Solana last month. The Sunday attack targeted Hyperbridge's EthereumHost contract, specifically the validation process for incoming cross-chain messages, which are used to facilitate token transfers between different blockchains.
The vulnerability enabled the attacker to forge a message, granting them admin control over the bridged Polkadot token contract, and ultimately allowing them to mint a vast number of tokens. However, due to limited liquidity in the market, the attacker's potential gains were significantly curtailed, resulting in a relatively modest profit. The exploit underscores the weaknesses inherent in cross-chain architecture, particularly in bridges that hold admin-level control over token contracts on destination chains, making them vulnerable to validation failures that can have far-reaching consequences.
In this instance, the attacker submitted a forged message via the dispatchIncoming function, which was then routed to TokenGateway.onAccept. The request receipts check, responsible for verifying the message against a valid cross-chain state commitment from Polkadot, was either absent or circumventable, allowing the gateway to process the message as legitimate.
The accepted message then executed a changeAdmin function on the bridged Polkadot token contract, transferring admin rights to the attacker's address. With admin control, the attacker proceeded to mint 1 billion tokens in a single transaction and sold them through Odos Router V3 into a Uniswap V4 DOT-ETH pool, extracting approximately 108.2 ETH across multiple swaps at varying prices.
The limited liquidity in the market worked against the attacker, as the overwhelming number of tokens flooded the available liquidity, resulting in the attacker receiving only a fraction of a cent per token. On a deeper pool or with a higher-value bridged asset, the same vulnerability could have led to substantially larger losses. As of Monday morning, DOT was trading just below $1.20.
The incident was flagged by CertiK, which confirmed the attack vector was the Hyperbridge gateway contract, resulting in the attacker's profit of approximately $237,000 from minting and selling the bridged tokens. Hyperbridge has yet to publicly comment on the exploit or disclose whether other bridged token contracts using the same gateway are vulnerable to the same forged-message attack vector.