While cryptocurrency hacks are not uncommon, it is rare for attackers to take significant risks and end up with relatively small gains. This unusual scenario occurred on Sunday when an attacker exploited a vulnerability in the Hyperbridge cross-chain gateway, which connects different blockchains, to mint 1 billion Polkadot tokens, valued at $1.19 billion, on the Ethereum network and sell them for around $237,000 worth of ether.
This incident is the latest in a series of bridge vulnerabilities in 2026, including a $270 million exploit on the Drift Protocol on Solana last month. The attack targeted the bridge contract and not Polkadot's core network, with the native DOT token remaining unaffected. The vulnerability was found in the way the Hyperbridge EthereumHost contract validated incoming cross-chain messages before passing them to the TokenGateway.
Bridges, which facilitate the transfer of coins between different blockchains, are often the weakest link in cross-chain architecture due to their administrative control over token contracts on destination chains, making them vulnerable to attacks. The attack began when the attacker submitted a forged message via the dispatchIncoming function, which was then routed to the TokenGateway.onAccept function. The request receipts check, which should have verified the message against a valid cross-chain state commitment from Polkadot, stored an all-zeros commitment value, indicating that the proof validation was either missing or could be circumvented for this specific call path. As a result, the gateway processed the message as legitimate.
The accepted message then executed the changeAdmin function on the bridged Polkadot token contract, transferring administrative rights to the attacker's address. With administrative control, the attacker minted 1 billion tokens in a single transaction and transferred them to a Uniswap V4 DOT-ETH pool via the Odos Router V3, extracting around 108.2 ETH across multiple swaps at slightly different prices.
However, the attacker's gains were limited due to the weak liquidity in the bridged DOT pool on Ethereum, which meant that the 1 billion tokens overwhelmed the available liquidity, resulting in the attacker receiving only a fraction of a cent per token. If the same vulnerability had been exploited on a deeper pool or a higher-value bridged asset, the losses would have been significantly larger. The DOT token was trading at just under $1.20 as of Monday morning.
The exploit was flagged by CertiK, which confirmed that the attack vector was the Hyperbridge gateway contract and that the attacker profited approximately $237,000 from minting and selling the bridged tokens. Hyperbridge has not publicly commented on the exploit or disclosed whether other bridged token contracts using the same gateway are vulnerable to the same forged-message attack vector.