While crypto hacks are a common occurrence, instances where attackers take significant risks only to reap minimal rewards are rare. Such a scenario unfolded on Sunday when an attacker leveraged a vulnerability in Hyperbridge's cross-chain gateway to mint and sell 1 billion Polkadot tokens, valued at $1.19 billion, for approximately $237,000 in ether. This exploit highlights the growing list of bridge vulnerabilities in 2026, following a $270 million Drift Protocol incident on Solana last month. The attack targeted the bridge contract, specifically the EthereumHost contract's validation process for incoming cross-chain messages, rather than Polkadot's core network, leaving the native DOT token unaffected.
Bridges, which facilitate coin transfers between blockchains, are often the weakest link due to their admin-level control over token contracts, making them susceptible to attacks. In this case, a forged message submitted via dispatchIncoming was routed to TokenGateway.onAccept, bypassing the request receipts check that verifies messages against valid cross-chain state commitments from Polkadot.
The attacker gained admin rights to the bridged Polkadot token contract, minted 1 billion tokens, and sold them through Odos Router V3 and Uniswap V4, resulting in roughly 108.2 ETH. However, the limited liquidity in the DOT-ETH pool on Ethereum restricted the attacker's profit.
If the vulnerability had been exploited on a deeper pool or a higher-value bridged asset, the losses would have been substantially greater. The incident was flagged by CertiK, confirming the attack vector and estimated profit of $237,000.
Hyperbridge has yet to publicly comment on the exploit or disclose whether other bridged token contracts are vulnerable to similar attacks.