On April 13, blockchain security firm Certik alerted the crypto community to an exploit of the Hyperbridge gateway on Ethereum. A malicious actor minted 1 billion unauthorized Polkadot (DOT) tokens by exploiting a replay vulnerability. The price of DOT briefly plunged from $1.23 to $1.16, a drop of nearly 6%, before recovering to $1.19 at the time of writing.
The Attack: Replay Flaw and Liquidity Bottleneck
According to on-chain data and security reports, the attacker used a fabricated message to gain administrative privileges over the bridged DOT contract on Ethereum, triggering a single transaction that generated the 1 billion tokens. However, due to shallow liquidity of the bridged DOT on Ethereum, the perpetrator was unable to cash out at market value.
Analysis from Lookonchain confirms the hacker liquidated the entire haul in a single swap, yielding approximately 108.2 Ether (valued at roughly $237,000). Had the asset been more widely traded, the financial impact could have been substantially higher.
Root Cause: Merkle Mountain Range Vulnerability
In its initial post-mortem, Certik said the exploit stemmed from a replay vulnerability in Merkle Mountain Range’s calculateroot function. This flaw meant that proofs were not properly bound to requests, allowing attackers to reuse old state commitments. Downstream, the tokengateway.handlechangeadmin function failed to enforce strict checks, letting attackers arbitrarily input request data.
Certik noted: “The attacker submitted ‘proof’ value is copied from the ‘_stateCommitments’ in a previous txn… thus making the replay possible.”
Limited Impact on Core Network and Market
Security experts clarified that the breach was localized to the Hyperbridge gateway on Ethereum. Polkadot’s core relay chain and authentic DOT tokens remained secure and unaffected. The price dip was short-lived, reflecting the market’s rational assessment of the isolated incident.
Hyperbridge has yet to release a full post-mortem, but developers are expected to deploy patches to secure administrative smart contract functions and prevent future exploits. Certik recommends all bridge projects strengthen proof verification and permission controls.