Attacker Exploits Hyperbridge Vulnerability, Mints $1 Billion in Polkadot Tokens on Ethereum but Only Nets $250,000

Cryptocurrency hacks have become commonplace, but instances where attackers take substantial risks only to reap minimal rewards are rare. One such unusual case occurred on Sunday, when an attacker exploited a vulnerability in Hyperbridge's cross-chain gateway, connecting various blockchains, to mint 1 billion Polkadot tokens, valued at $1.19 billion, on the Ethereum network, and subsequently sold them for roughly $237,000 worth of ether.

This exploit highlights the growing list of bridge vulnerabilities in 2026, following a $270 million Drift Protocol incident on Solana last month. The targeted bridge contract, rather than Polkadot's core network, contained the vulnerability, which lay in the validation process of incoming cross-chain messages by Hyperbridge's EthereumHost contract before passing them to the TokenGateway. Bridges, facilitating the transfer of coins between blockchains, remain a weak link due to their admin-level control over token contracts on destination chains, making them susceptible to attacks that can grant unlimited supply minting capabilities with a single validation failure. The attack unfolded with the submission of a forged message via dispatchIncoming, routed to TokenGateway.onAccept, which lacked proper proof validation, allowing the message to be processed as legitimate.

This led to the execution of changeAdmin, transferring admin rights to the attacker, who then minted 1 billion tokens and sold them through Odos Router V3 and Uniswap V4, resulting in approximately 108.2 ETH. However, the limited liquidity of the bridged DOT pool on Ethereum worked against the attacker, capping their profit.

The low liquidity meant that the 1 billion tokens overwhelmed the available liquidity, resulting in the attacker receiving only a fraction of a cent per token. This vulnerability could have led to significantly larger losses if the pool had been deeper or the asset more valuable. As of Monday morning, DOT was trading just under $1.20.

The exploit was flagged by CertiK, confirming the attack vector and the attacker's profit of approximately $237,000. Hyperbridge has yet to publicly comment on the incident or disclose whether other bridged token contracts using the same gateway are vulnerable to similar attacks.