Attacker Exploits Polkadot Token Vulnerability on Ethereum, Nets Only $250,000

While cryptocurrency hacks are not uncommon, instances where attackers assume significant risk only to gain minimal rewards are rare. Such a scenario occurred on a recent Sunday, as an attacker exploited a vulnerability in a cross-chain gateway, minting 1 billion Polkadot tokens on the Ethereum network and exchanging them for roughly $237,000 in ether. This incident contributes to a growing list of bridge vulnerabilities in 2026, including a $270 million Drift Protocol hack on Solana and a social engineering attack that compromised infrastructure.

The exploit targeted the bridge contract rather than Polkadot's core network, leaving the native DOT token unaffected. The vulnerability stemmed from the validation process of incoming cross-chain messages by Hyperbridge's EthereumHost contract.

Bridges, which facilitate the transfer of coins between blockchains, remain a weak point in cross-chain architecture due to their administrative control over token contracts on destination chains. A single validation failure can grant an attacker unlimited token minting capabilities. The attack unfolded when the attacker submitted a forged message via dispatchIncoming, which was routed to TokenGateway.onAccept. The request receipts check failed to verify the message against a valid cross-chain state commitment from Polkadot, allowing the gateway to process the message as legitimate.

The accepted message executed changeAdmin on the bridged Polkadot token contract, transferring administrative rights to the attacker's address. With administrative control, the attacker minted 1 billion tokens and sold them through Odos Router V3 into a Uniswap V4 DOT-ETH pool, earning approximately 108.2 ETH.

However, the limited liquidity of the bridged DOT pool on Ethereum worked against the attacker, capping their profit. The attacker's gain would have been significantly larger if the vulnerability had been exploited on a deeper pool or a higher-value bridged asset. As of Monday morning, DOT was trading just below $1.20. CertiK identified the exploit, confirming that the attack vector involved the Hyperbridge gateway contract and resulted in a profit of approximately $237,000 from minting and selling the bridged tokens.

Hyperbridge has not publicly commented on the exploit or disclosed whether other bridged token contracts using the same gateway are vulnerable to the same attack vector.