Attacker Exploits Polkadot Token Vulnerability on Ethereum, Nets Only $250,000

While cryptocurrency hacks are commonplace, instances where attackers incur significant risk only to reap relatively modest rewards are rare. Such an incident occurred on Sunday, involving the exploitation of a vulnerability in Hyperbridge's cross-chain gateway, which connects disparate blockchains.

The attacker successfully minted 1 billion Polkadot tokens, valued at $1.19 billion, on the Ethereum network and subsequently sold them for approximately $237,000 in ether. This exploit contributes to the growing list of bridge vulnerabilities in 2026, following a $270 million drain on Solana's Drift Protocol last month. The Sunday attack targeted the bridge contract, leaving Polkadot's core network and native token DOT unaffected. The vulnerability stemmed from the validation process of incoming cross-chain messages by Hyperbridge's EthereumHost contract before passing them to the TokenGateway.

Bridges, facilitating the transfer of coins between blockchains, remain a weak link in cross-chain architecture due to their admin-level control over token contracts on destination chains. A single validation failure can grant an attacker unlimited token minting capabilities. The attack unfolded through the submission of a forged message via dispatchIncoming, routed to TokenGateway.onAccept, where the request receipts check failed to verify the message against a valid cross-chain state commitment from Polkadot.

This allowed the attacker to execute changeAdmin on the bridged Polkadot token contract, transferring admin rights and subsequently minting 1 billion tokens. The tokens were then routed through Odos Router V3 into a Uniswap V4 DOT-ETH pool, yielding roughly 108.2 ETH. The limited liquidity of the bridged DOT pool on Ethereum worked against the attacker, resulting in a significantly lower profit than anticipated. The same vulnerability could have produced substantially larger losses on a deeper pool or higher-value bridged asset.

As of Monday morning, DOT traded just under $1.20. CertiK identified the exploit, confirming the attack vector as the Hyperbridge gateway contract, with the attacker profiting around $237,000 from the minting and sale of the bridged tokens. Hyperbridge has yet to publicly address the exploit or disclose whether other bridged token contracts using the same gateway are vulnerable to similar attacks.