Cryptocurrency hacks have become all too common, but instances where attackers take significant risks only to reap minimal rewards are rare. One such unusual case occurred on Sunday, when an attacker exploited a vulnerability in a cross-chain bridge, resulting in the minting of 1 billion Polkadot tokens, valued at $1.19 billion, on the Ethereum network. However, due to the attacker's decision to dump these tokens, they only managed to secure approximately $237,000 worth of ether.
This incident highlights the ongoing issue of bridge vulnerabilities in 2026, following a $270 million exploit on Solana's Drift Protocol last month, as well as a social engineering attack that compromised infrastructure. The attack in question targeted the bridge contract, rather than Polkadot's core network, and did not affect the native DOT token. The vulnerability stemmed from the way Hyperbridge's EthereumHost contract validated incoming cross-chain messages before passing them to the TokenGateway, essentially allowing an attacker to gain admin-level control over token contracts on destination chains. The exploit took advantage of a weakness in the validation process, submitting a forged message that was accepted as legitimate, thereby granting the attacker the ability to mint an unlimited supply of tokens.
A step-by-step analysis of the attack reveals that the attacker submitted a forged message via dispatchIncoming, which was then routed to TokenGateway.onAccept. However, the request receipts check failed to verify the message against a valid cross-chain state commitment from Polkadot, instead storing an all-zeros commitment value, indicating that the proof validation was either absent or circumventable for this specific call path. As a result, the gateway processed the message as legitimate, allowing the attacker to execute a changeAdmin function on the bridged Polkadot token contract, effectively transferring admin rights to their address.
With this newfound control, the attacker proceeded to mint 1 billion tokens in a single transaction, routing them through Odos Router V3 into a Uniswap V4 DOT-ETH pool, from which they extracted roughly 108.2 ETH across multiple swaps at varying prices. The limited liquidity of the bridged DOT pool on Ethereum ultimately worked against the attacker, capping their potential profit. If the attack had occurred on a deeper pool or involved a higher-value bridged asset, the resulting losses would have been significantly more substantial.
At the time of the attack, DOT was trading at just under $1.20. The exploit was flagged by CertiK, which confirmed that the attack vector involved the Hyperbridge gateway contract and that the attacker profited approximately $237,000 from minting and selling the bridged tokens. Hyperbridge has yet to publicly comment on the exploit or disclose whether other bridged token contracts using the same gateway are vulnerable to the same forged-message attack vector.