Hyperbridge Exploit Mints 1B DOT Tokens in Attack, CertiK Reports

The attacker then minted the tokens, though limited liquidity in the bridged DOT pool capped the haul at 108.2 Ethereum.

Crypto News

A hacker has exploited Hyperbridge, a cross-chain interoperability protocol built on Polkadot, minting 1 billion bridged DOT tokens in a single transaction on Ethereum and walking away with approximately $237,000 in proceeds.

Cybersecurity platform CertiK confirmed the attack using

data, saying the hacker inserted a forged message to seize admin control of the Polkadot token contract on Ethereum. The attacker then minted the tokens, though limited liquidity in the bridged DOT pool capped the haul at 108.2 Ethereum.

The exploit affected only DOT bridged through Hyperbridge on Ethereum. Native DOT tokens and the broader Polkadot ecosystem were not impacted, the project confirmed in a post on X.

Hyperbridge paused operations following the attack while its team worked on an upgrade. Contributor Web3 Philosopher said the initial diagnosis pointed to a malicious proof that fooled the protocol's Merkle tree verifier.

Blockchain security firm Blocksec Falcon identified the likely root cause as a Merkle Mountain Range proof replay vulnerability caused by missing proof-to-request binding, though the protocol had not confirmed a final root cause at the time of writing.