Blockchain security firm CertiK has flagged a critical vulnerability in the Hyperbridge gateway that allowed an attacker to mint 1 billion unauthorized DOT tokens on Ethereum. Following the disclosure, DOT fell from $1.23 to $1.16, a drop of nearly 6%, before recovering part of the loss to around $1.19.
The breach hit bridged DOT on Ethereum, not Polkadot itself
According to onchain data and security reporting, the attacker exploited a weakness in Hyperbridge’s smart contract logic. By using a forged message to obtain admin rights over the bridged DOT contract on Ethereum, the attacker triggered a single transaction that minted the massive token supply. Even so, the exploiter could not realize the full face value of the fake tokens because liquidity for the Ethereum-based bridged DOT asset was limited.
Analysis from Lookonchain showed that the attacker swapped the entire haul in one transaction and walked away with about 108.2 ETH, worth roughly $237,000 at the time. That outcome suggests the financial damage could have been significantly worse if the bridged asset had deeper market liquidity.
Replay weakness and loose admin checks were central to the exploit
In its preliminary analysis, CertiK said the issue stemmed from a replay vulnerability in the Merkle Mountain Range calculateroot function. The proof was not properly bound to the underlying request, allowing old state commitments to be reused. The problem was compounded by insufficient validation in tokengateway.handlechangeadmin, which let the attacker inject arbitrary request data and ultimately change the token administrator.
CertiK said the attacker’s submitted “proof” value was copied from the _stateCommitments field of a previous transaction, making the replay possible. Hyperbridge has not yet published a full post-mortem on the gateway contract issue, but developers are expected to roll out fixes aimed at hardening administrative smart contract functions against similar attacks.
Native DOT and the Polkadot relay chain remain unaffected
Security researchers stressed that the incident was confined to the Hyperbridge environment on Ethereum. The Polkadot relay chain and native DOT on the Polkadot network were not impacted. In practical terms, the breach affected bridged representations of DOT and the associated Ethereum-side contract infrastructure, rather than Polkadot’s core network.