While cryptocurrency hacks are not uncommon, instances where attackers take significant risks only to gain minimal rewards are rare. Such a scenario unfolded on Sunday when an attacker exploited a weakness in the Hyperbridge cross-chain gateway, connecting various blockchains, to mint 1 billion Polkadot tokens, valued at $1.19 billion, on the Ethereum network, and subsequently sold them for approximately $237,000 in ether. This incident contributes to the growing list of bridge vulnerabilities in 2026, following a $270 million drain from the Drift Protocol on Solana last month.
The Sunday attack targeted the bridge contract, leaving Polkadot's core network and its native DOT token unaffected. The vulnerability stemmed from the validation process of incoming cross-chain messages by Hyperbridge's EthereumHost contract before they were passed to the TokenGateway. Bridges, which facilitate the transfer of coins between different blockchains, remain a weak point in cross-chain architecture due to their admin-level control over token contracts on destination chains, making them susceptible to exploits where a single validation failure can grant an attacker unlimited minting capabilities.
The attack began with the submission of a forged message via dispatchIncoming, which was then routed to TokenGateway.onAccept. The request receipts check, intended to verify the message against a valid cross-chain state commitment from Polkadot, contained an all-zeros commitment value, indicating either the absence or circumvention of proof validation for this specific call path, leading the gateway to process the message as legitimate.
The accepted message executed a changeAdmin function on the bridged Polkadot token contract, transferring admin rights to the attacker's address. With this newfound control, the attacker minted 1 billion tokens in a single transaction and funneled them through Odos Router V3 into a Uniswap V4 DOT-ETH pool, extracting roughly 108.2 ETH across multiple swaps at slightly different prices.
However, the attacker's gain was capped due to weak liquidity in the bridged DOT pool on Ethereum, which was overwhelmed by the 1 billion tokens, resulting in the attacker receiving only a fraction of a cent per token. This limited liquidity worked against the attacker, unlike the typical scenario where it poses a challenge for large-scale traders. The same vulnerability could have led to significantly larger losses if the pool had been deeper or the bridged asset more valuable.
As of Monday morning, DOT was trading just under $1.20. The exploit was flagged by CertiK, confirming the attack vector as the Hyperbridge gateway contract, with the attacker profiting approximately $237,000 from the minting and sale of the bridged tokens.
Hyperbridge has yet to publicly comment on the exploit or disclose whether other bridged token contracts using the same gateway are vulnerable to similar forged-message attack vectors.