Hyperbridge suffered a cross-chain gateway exploit on Sunday that let an attacker mint 1 billion bridged Polkadot tokens on Ethereum. The face value was estimated at about $1.19 billion, but the attacker ultimately extracted only around 108.2 ETH, or roughly $237,000.
The incident did not affect the Polkadot base network. Native DOT remained untouched. The weakness was tied to how Hyperbridge’s EthereumHost contract handled validation of incoming cross-chain messages before forwarding them to the TokenGateway.
Forged message led to control of the token contract
On-chain traces show the attacker submitted a forged message through dispatchIncoming, which was then routed to TokenGateway.onAccept. A receipts check that should have matched the message against a valid cross-chain state commitment from Polkadot instead stored an all-zeros commitment value. That points to proof validation being missing on this path, or being bypassable in this specific call flow. The gateway accepted the message as valid.
Once accepted, the message triggered changeAdmin on the bridged Polkadot token contract, moving admin rights to the attacker’s address. With that access, the attacker minted 1 billion tokens in a single transaction, then routed them through Odos Router V3 into a Uniswap V4 DOT-ETH pool, exiting across what appeared to be multiple swaps at slightly different prices.
Shallow liquidity sharply limited the payoff
The attacker’s main constraint was the limited depth of the bridged DOT pool on Ethereum. That pool could not absorb an order of this size at stable prices, so the massive token dump crushed execution value and left the attacker receiving only a tiny fraction of a cent per token. Poor liquidity is often a problem for large holders. Here, it cut the proceeds of the exploit.
The source article noted that DOT was trading just below $1.20 during Asian morning hours on Monday. If the same flaw had existed in a deeper pool, or in a bridged asset with stronger on-chain liquidity and a higher unit price, the financial damage could have been much larger.
Bridge validation remains a critical weak point
Bridges move assets between chains, but they often hold admin-level control over token contracts on destination networks. A single failure in message verification can hand an attacker the ability to mint unlimited supply. That makes bridge validation one of the highest-risk parts of cross-chain design.
CertiK flagged the exploit and said the attack path involved the Hyperbridge gateway contract, with profit of about $237,000 from minting and dumping the bridged tokens. At the time covered by the source, Hyperbridge had not issued a public statement and had not disclosed whether other bridged token contracts using the same gateway could face the same forged-message vector.