DOT falls after hacker mints 1 billion tokens through Polkadot bridge flaw

Traders Union
All News
Crypto News
DOT falls after hacker mints 1 billion tokens

Highlights

The attacker minted 1 billion bridged DOT on Ethereum and sold the tokens through a liquidity pool.
DOT briefly fell from around $1.23-$1.24 to $1.15-$1.16 before partially recovering.
The attacker withdrew about 108.2 ETH, or roughly $237,000, because of the low liquidity of the bridged token.
The Polkadot main network and native DOT were not affected; the vulnerability was in the Hyperbridge gateway on Ethereum.

The exploit hit the bridge, not the main network

According to Arkham and Lookonchain, the attacker minted 1 billion bridged DOT on Ethereum and immediately sold the tokens into a liquidity pool. Despite the massive nominal amount, the attacker was unable to cash out at market value because the bridged version of DOT had limited liquidity, capping the haul at about 108.2 ETH, or roughly $237,000-$240,000.

Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

The key point for the market is that the incident did not affect the native DOT token on the Polkadot main network. Analysts and security researchers said the issue was confined to the Hyperbridge gateway on Ethereum, while the Polkadot relay chain and genuine DOT on Polkadot remained unaffected. That left the damage more reputational and market-driven than systemic for the broader network.

Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

How the flaw worked

According to an initial analysis by CertiK, the attack was made possible by a replay vulnerability in the calculateRoot function of the Merkle Mountain Range service. As a result, state proofs were not tightly bound to specific requests, allowing previously used state commitments to be reused. In addition, the tokenGateway.handleChangeAdmin function did not strictly validate input data, opening a path for the attacker to change the admin of the bridged DOT contract on Ethereum.

After gaining that level of control, the attacker executed a single transaction that minted the full 1 billion tokens and then sold them. The episode again highlighted the vulnerability of cross-chain bridges: even when the base network is not compromised, an attack on the connecting contract can still trigger an immediate market reaction.

Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

What the incident means for the market

One of the weakest points in crypto infrastructure remains bridge design, rather than necessarily the underlying blockchains themselves. Second, it shows how sharply a token can react even to a localized incident: DOT lost more than 6%-7% in a matter of minutes, even though the attacker’s actual profit was limited to about $237,000 because of thin liquidity.

For Polkadot, that means moving quickly to patch the vulnerability and convince the market that the issue was truly limited to the Ethereum bridge. Until Hyperbridge publishes a full post-mortem, the clearest picture of what happened still comes from on-chain data and CertiK’s preliminary technical analysis.

It was earlier reported that Polkadot caps DOT supply and cuts issuance rate.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.