Liquidity Limits Capped a $1 Billion Hyperbridge Exploit at $250,000

An attacker converted approximately $237,000 to $250,000 into real value after minting one billion fraudulent Polkadot (DOT) tokens on Ethereum. The theft was limited by the lack of liquidity in the bridged DOT pools on Ethereum, which collapsed the price of the bridged token by more than 90% as the attacker attempted to dump the volume.

According to blockchain security firm CertiK, the attacker exploited a vulnerability in the Hyperbridge protocol that allowed them to forge a legitimate-looking cross-chain message. This forgery granted the attacker admin control of the bridged DOT contract on Ethereum, enabling them to mint one billion tokens from thin air. The attacker then routed the tokens through Odos and Uniswap in a single coordinated transaction.

Polkadot noted that its relay chain was not compromised and native DOT held on its own network remained unaffected. The incident was contained entirely to the bridged representation of the token living on Ethereum, a separate asset with its own contract and risk profile. Hyperbridge has paused operations and is investigating the root cause.