On Sunday, an attacker exploited a flaw in Hyperbridge’s Ethereum gateway contract, minted one billion bridged Polkadot tokens worth over $1 billion on paper, and dumped them all. They walked away with $237,000. Shallow liquidity in Ethereum’s DOT pool turned a potential nine-figure heist into a rounding error.
How the Hyperbridge exploit unfolded
The flaw was a proof replay vulnerability in Hyperbridge’s Merkle Mountain Range calculation. When a specific edge case applied, a leaf count of one, the function failed to bind the proof to the request data. That let the attacker reuse a previously accepted proof, pair it with a new request, and slip past the validation check.
The attacker sent a forged message through Hyperbridge’s dispatchIncoming function. The gateway processed it as legitimate, triggering a changeAdmin call on the bridged DOT token contract and handing admin rights to the attacker’s address. With admin control secured, the attacker minted one billion tokens in a single transaction, then routed them through Odos Router V3 into a Uniswap V4 DOT-ETH pool, extracting roughly 108 ETH, about $237,000, across multiple swaps.
Polkadot confirmed the exploit only affects DOT bridged through Hyperbridge on Ethereum. Native DOT, Polkadot’s parachains, and DOT moved through other bridges were untouched. Native DOT still fell roughly 4%, and South Korean exchanges Upbit and Bithumb temporarily suspended DOT deposits and withdrawals. Hyperbridge has been paused while the investigation runs.
Polkadot’s third bridge hack in four years
Polkadot has been here before. In 2022, the Nomad bridge was drained for $200 million. In 2025, an XCM bridge exploit cost $35 million. Sunday’s Hyperbridge exploit was the smallest of the three, but the pattern holds: the core chain stays safe, the bridge gets hit.
Bridges hold admin-level control over token contracts on destination chains. One validation failure can let an attacker mint unlimited supply. That’s the structural risk that makes bridges the weakest point in cross-chain architecture, and it’s not a problem unique to Polkadot.
Why the attacker only walked away with $237,000
The $237,000 figure looks small. But it reflects how little liquidity was in the Ethereum DOT pool, not how bad the flaw was. One billion tokens overwhelmed the available depth instantly, so the attacker got fractions of a cent per token. Run the same exploit against a deeper pool or a higher-value bridged asset and the number looks very different. Tens of millions, not hundreds of thousands.
CertiK confirmed the attack and the profit figure. The attacker has since moved the ETH through Railgun, a privacy protocol that makes transaction origins difficult to trace. Hyperbridge hasn’t said whether other contracts on the same gateway share the same vulnerability. That’s the part nobody has answered yet.
