Polkadot-linked markets briefly came under pressure after a major bridge exploit. Blockchain security firm Certik reported that a vulnerability in the Hyperbridge gateway allowed an attacker to mint 1 billion unauthorized DOT tokens on Ethereum. Following the incident, DOT fell from $1.23 to $1.16, a drop of nearly 6%, before recovering part of the loss to around $1.19.
The exploit was isolated to the Ethereum bridge
According to on-chain data and security reports, the attacker abused a flaw in the Hyperbridge smart contract by using a forged message to obtain administrative control over the bridged DOT contract on Ethereum. That access enabled a single transaction to mint the massive supply. Even so, the attacker was unable to realize anything close to the face value of the counterfeit tokens because bridged DOT liquidity on Ethereum was limited.
Analysis from Lookonchain showed that the attacker dumped the full 1 billion tokens in a single swap, receiving about 108.2 ETH, worth roughly $237,000 at the time. The episode highlighted how shallow liquidity contained the realized damage. Had the bridged asset traded more deeply across markets, the financial impact could have been far greater.
Native Polkadot remained unaffected
Security researchers were quick to note that the breach did not affect Polkadot’s main relay chain or native DOT on the Polkadot network. The issue was confined to the Hyperbridge implementation on Ethereum, not the core Polkadot protocol itself.
In its preliminary post-mortem, Certik said the exploit stemmed from a replay vulnerability in the Merkle Mountain Range calculateroot function. Because proofs were not properly bound to requests, old state commitments could be reused. Certik added that the tokengateway.handlechangeadmin function failed to enforce strict checks, allowing arbitrary request data to pass through and eventually letting the attacker change the admin of the Polkadot token contract.
Certik further noted that the “proof” submitted by the attacker had been copied from _stateCommitments in an earlier transaction, making replay possible. As of publication, Hyperbridge had not yet released a full technical breakdown, but developers are expected to deploy patches to harden administrative controls and request validation against similar attacks.