Attacker Exploits Polkadot Token Vulnerability on Ethereum, Nets Only $250,000

Cryptocurrency hacks have become increasingly common, but instances where attackers take significant risks only to gain minimal rewards are rare. One such incident occurred on Sunday, when an attacker exploited a vulnerability in Hyperbridge's cross-chain gateway to mint 1 billion Polkadot tokens on Ethereum, valued at $1.19 billion, but ultimately only sold them for approximately $237,000 worth of ether. This exploit highlights the ongoing issue of bridge vulnerabilities, which have been a recurring problem in 2026, including a $270 million Drift Protocol hack on Solana last month.

The Sunday attack targeted Hyperbridge's EthereumHost contract, specifically the validation process for incoming cross-chain messages, which allowed the attacker to submit a forged message and gain admin control over the bridged Polkadot token contract. The vulnerability in the bridge contract, rather than Polkadot's core network, meant that the native DOT token was unaffected. Bridges remain a weak point in cross-chain architecture due to their admin-level control over token contracts on destination chains, making them susceptible to attacks that can grant unlimited supply.

The attack unfolded when the attacker submitted a forged message via dispatchIncoming, which was routed to TokenGateway.onAccept without proper validation, allowing the attacker to execute changeAdmin and transfer admin rights to their address. With admin control, the attacker minted 1 billion tokens and sold them through Odos Router V3 and Uniswap V4, but limited liquidity in the DOT-ETH pool meant they only extracted around 108.2 ETH.

The low liquidity ultimately worked against the attacker, capping their profit. If the same vulnerability were exploited on a deeper pool or higher-value asset, the losses could have been significantly greater. The incident was flagged by CertiK, which confirmed the attack vector and estimated the attacker's profit at approximately $237,000.

Hyperbridge has yet to comment publicly on the exploit or disclose whether other bridged token contracts using the same gateway are vulnerable to similar attacks.