A major cross-chain security incident has hit the Polkadot ecosystem’s bridged asset infrastructure on Ethereum. According to blockchain security firm Certik, an attacker exploited the Hyperbridge gateway to mint 1 billion unauthorized DOT tokens on Ethereum. The market reacted quickly: DOT fell from $1.23 to $1.16, a drop of nearly 6%, before recovering part of the decline to around $1.19.
The breach was limited to bridged DOT on Ethereum
Initial reporting and onchain analysis indicate that the incident did not compromise Polkadot’s core relay chain or native DOT on the Polkadot network. Instead, the exploit affected the Ethereum-side representation of DOT created through the Hyperbridge gateway. That distinction matters because it means the problem was localized to a bridge-related smart contract environment rather than the base layer of Polkadot itself.
Certik said the attacker used a fabricated message to gain administrative control over the bridged DOT contract on Ethereum. Once that access was obtained, the exploiter executed a single transaction that minted the full 1 billion tokens. The scale of the minting immediately raised alarm, but the actual economic damage was constrained by one key factor: liquidity.
Replay vulnerability opened the door
In its preliminary post-mortem, Certik attributed the exploit to a replay flaw tied to the Merkle Mountain Range calculateroot function. The issue meant that proof data was not properly bound to a specific request, allowing old state commitments to be reused. In practical terms, this gave an attacker a way to replay previously valid data in a malicious context.
The problem appears to have been compounded further downstream. Certik said the tokengateway.handlechangeadmin function did not enforce sufficiently strict checks, making it possible for an attacker to pass arbitrary request data. That weakness enabled malicious logic to move through the system unchecked and ultimately allowed the attacker to alter the admin of the Polkadot token contract on Ethereum.
Certik summarized the flaw by noting that the submitted proof value was copied from a prior transaction’s state commitments, which made the replay possible. Taken together, the bug chain shows how cross-chain systems can fail when message verification, proof binding, and privileged function controls are not tightly coordinated.
Huge token mint, limited cash-out
While the unauthorized mint totaled an eye-catching 1 billion DOT, the attacker could not realize anything close to the nominal market value of that amount. The bridged DOT asset on Ethereum had shallow liquidity, severely limiting how much value could be extracted from the exploit.
Lookonchain reported that the attacker dumped the entire balance in a single swap, receiving roughly 108.2 ETH, worth around $237,000 at the time. The episode is a reminder that exploit size on paper does not always translate into equivalent financial gain. In this case, poor liquidity acted as a brake on losses, even though the underlying security failure was serious.
That dynamic also frames the broader risk. Had the Ethereum-side bridged DOT market been deeper and more actively traded, the same exploit could have resulted in materially larger proceeds for the attacker and more severe dislocation for traders and liquidity providers.
Market reaction hit DOT, but losses were partially reversed
The token’s price action reflected the market’s sensitivity to any event involving unauthorized minting. DOT briefly slid from $1.23 to $1.16 after news of the exploit spread. Although the move represented a sharp short-term sell-off, the token later recovered some of the losses and traded around $1.19 at the time of reporting.
The rebound suggests that at least part of the market recognized the technical scope of the incident. Investors appeared to distinguish between a compromise of a bridge gateway on Ethereum and a direct failure of Polkadot’s core network. Even so, the sell-off showed that bridge exploits can create immediate reputational and pricing pressure across an ecosystem, regardless of whether the base chain itself is affected.
Patch expectations now center on admin controls and replay protection
Hyperbridge had not yet released a full post-mortem detailing the gateway smart contract flaw at the time of the report. However, developers are widely expected to implement fixes aimed at preventing similar incidents in the future. Based on Certik’s findings, those fixes will likely focus on stronger replay protection, stricter validation of administrative change requests, and more robust cross-chain message verification.
For users and developers, the incident highlights a familiar industry lesson: cross-chain infrastructure remains one of crypto’s most fragile layers. Even when a core chain is untouched, vulnerabilities in bridge contracts and wrapped-asset systems can create fake supply, disrupt markets, and damage confidence in related tokens.
In this case, Polkadot’s main network and native DOT were reported to remain secure. But the Hyperbridge exploit demonstrates how quickly trust can erode when administrative controls fail in a bridge environment. It also reinforces why security reviews of gateway contracts, proof systems, and privilege boundaries remain essential for any protocol that extends assets across multiple chains.