Liquidity Constraints Capped Hyperbridge Exploit at $240,000 Despite 1 Billion Token Mint

The attacker of a recent cross-chain exploit realized between $237,000 and $240,000 in ETH despite minting 1 billion bridged DOT tokens. Liquidity constraints in Ethereum's bridged-DOT pools capped the profit, preventing the attacker from realizing the full theoretical value of the minted supply. To obtain the funds, the attacker routed the tokens through Uniswap and OdosRouteV3.

The breach occurred when a hacker used a forged message to alter the admin of the Polkadot token contract on Ethereum via the Hyperbridge protocol. This access enabled the minting of the 1 billion tokens. Blocksec Falcon identified the likely root cause as an MMR proof replay vulnerability resulting from missing proof-to-request binding, though Hyperbridge has not publicly confirmed a final root-cause assessment.

Hyperbridge has halted operations to implement an upgrade. Polkadot noted that the incident affected only DOT on Ethereum bridged through Hyperbridge; native DOT tokens and the broader Polkadot ecosystem were not impacted. The attacker drained approximately 108.2 ETH, worth roughly $237,000 to $240,000.