Attacker Exploits Polkadot Token Vulnerability on Ethereum, But Gains Are Limited

Cryptocurrency hacks have become increasingly common, but it's rare for attackers to take significant risks and end up with relatively minor gains. However, this is exactly what happened on Sunday when an attacker exploited a vulnerability in Hyperbridge's cross-chain gateway, which connects different blockchains, and minted 1 billion Polkadot tokens on Ethereum, valued at $1.19 billion, only to sell them for approximately $237,000 worth of ether. This incident highlights the growing list of vulnerabilities in bridge protocols, following a $270 million exploit on Solana's Drift Protocol last month. The attack targeted the bridge contract, not Polkadot's core network, and the native DOT token remained unaffected.

The vulnerability was found in the way Hyperbridge's EthereumHost contract validates incoming cross-chain messages before passing them to the TokenGateway, allowing the attacker to submit a forged message and gain admin control over the bridged Polkadot token contract. Bridges are often the weakest link in cross-chain architecture, as they hold admin-level control over token contracts on destination chains, making them a prime target for attackers. In this case, the attacker was able to mint 1 billion tokens and sell them on Uniswap, but the low liquidity of the DOT-ETH pool limited their gains.

The attacker's profits were further reduced due to the limited depth of the pool, which meant that the 1 billion tokens overwhelmed the available liquidity, resulting in a fraction of a cent per token. If the same vulnerability were to be exploited on a deeper pool or a higher-value bridged asset, the losses could have been significantly larger.

The incident was flagged by CertiK, which confirmed that the attack vector was the Hyperbridge gateway contract and that the attacker profited approximately $237,000 from minting and selling the bridged tokens. Hyperbridge has yet to publicly comment on the exploit or disclose whether other bridged token contracts using the same gateway are vulnerable to the same attack vector.