Hyperbridge’s bridge exploit has turned out to be far larger than first reported, with total losses climbing from $237,000 to $2.5 million. The updated figure does not only cover protocol-level damage. It also includes funds deposited by users in incentive pools tied to the bridge. The attack took place on April 13, 2026, and early messaging said user assets were safe. Later updates showed that was not the full picture.
Fake DOT minting triggered losses across four networks
According to the disclosed details, the attacker breached the Hyperbridge Token Gateway, minted 1 billion fake DOT, and sold the tokens into the market. On Ethereum alone, the immediate dump brought the attacker about 245 ETH. That was only the visible part. The larger damage came from what followed across multiple chains.
The affected networks were Ethereum, Base, BNB Chain, and Arbitrum. As the fake DOT was dumped, the price of bridged DOT collapsed to nearly zero. Pool pricing broke down. Users rushed to withdraw whatever they could, and that scramble pulled funds out of pools belonging to legitimate liquidity providers, emptying incentive pools in the process.
User deposits were part of the realized loss
The revised $2.5 million estimate matters because it includes more than treasury or protocol reserves. It covers losses in incentive pools where ordinary users had parked assets to earn rewards. Anyone who had funds in those pools on the four affected networks may be included in the final loss tally.
The bridge has since been frozen. Native DOT on the Polkadot main chain was not affected, but users who relied on the bridge now face direct exposure. For many, this was not just a temporary pricing shock. Funds were drained from the pools they were using.
Recovery and compensation may take a long time
Hyperbridge said it will try to address the fallout, but the current recovery path points to a long wait. Based on the published plan, official recovery work through exchanges such as Binance could take more than a year.
If the stolen funds are not recovered, the team said it plans to compensate victims with BRIDGE tokens, though that would not happen until April 2027. At the same time, authorities are tracking all related wallets and have set a 14-day return window for people who withdrew extra funds during the panic before police involvement begins.