While cryptocurrency hacks are common, instances where attackers take substantial risks only to gain minimal rewards are rare. This unusual scenario unfolded on Sunday when an attacker exploited a weakness in the Hyperbridge cross-chain gateway, connecting various blockchains, and minted 1 billion Polkadot tokens, valued at $1.19 billion, on the Ethereum network, but only managed to exchange them for approximately $237,000 in ether. The incident highlights the growing list of bridge vulnerabilities in 2026, including the recent $270 million Drift Protocol breach on Solana.
The exploit targeted the bridge contract, specifically the Hyperbridge's EthereumHost contract, which failed to properly validate incoming cross-chain messages before passing them to the TokenGateway, allowing the attacker to gain admin control and mint unlimited tokens. Bridges remain the most vulnerable component in cross-chain architecture due to their control over token contracts on destination chains, making them susceptible to single validation failures. The attack began when the attacker submitted a forged message via dispatchIncoming, which was routed to TokenGateway.onAccept without proper validation.
This allowed the attacker to execute changeAdmin on the bridged Polkadot token contract, transferring admin rights and enabling them to mint 1 billion tokens in a single transaction, which were then routed through Odos Router V3 into a Uniswap V4 DOT-ETH pool, resulting in roughly 108.2 ETH across multiple swaps. However, the limited liquidity in the bridged DOT pool on Ethereum restricted the attacker's profit, as the 1 billion tokens overwhelmed the available liquidity, resulting in a fraction of a cent per token.
The vulnerability would have produced significantly larger losses if the pool had greater depth or if the bridged asset had a higher value. CertiK identified the exploit, confirming the attack vector was the Hyperbridge gateway contract, and that the attacker profited approximately $237,000 from minting and selling the bridged tokens. Hyperbridge has yet to publicly comment on the exploit or disclose whether other bridged token contracts using the same gateway are vulnerable to the same attack vector.