While cryptocurrency hacks are common, instances where attackers take significant risks and end up with relatively minor gains are rare. Such a scenario occurred on Sunday when an attacker exploited a vulnerability in a cross-chain bridge, minting 1 billion Polkadot tokens on the Ethereum network, valued at $1.19 billion, and selling them for approximately $237,000 in ether.
This incident highlights the ongoing issue of bridge vulnerabilities, following a $270 million exploit on Solana's Drift Protocol last month. The attack targeted the bridge contract, specifically the validation process for cross-chain messages in the EthereumHost contract, rather than Polkadot's core network, leaving the native DOT token unaffected.
The vulnerability allowed the attacker to submit a forged message, gaining administrative control over the bridged token contract and enabling them to mint a large quantity of tokens. However, due to limited liquidity in the market, the attacker was only able to realize a fraction of the potential value, ultimately profiting $237,000.
This incident underscores the risks associated with cross-chain bridges, which can provide attackers with administrative control over token contracts, and the importance of robust validation mechanisms to prevent such exploits.