On April 13, blockchain security firm Certik alerted the cryptocurrency community to a critical security breach in the Hyperbridge gateway, which enabled a malicious actor to mint 1 billion unauthorized Polkadot (DOT) tokens on the Ethereum network. In response, the DOT price briefly plunged from $1.23 to $1.16, a decline of nearly 6%. As of press time, the token had partially recovered to $1.19, though market sentiment remained cautious.
Exploit Details and Market Impact
According to on-chain data and security reports, the attacker exploited a vulnerability in the Hyperbridge gateway smart contract. By sending forged messages to obtain administrative privileges over the bridged DOT contract on Ethereum, the attacker triggered a transaction that generated 1 billion tokens. Despite the massive volume of minted tokens, the shallow liquidity of the bridged DOT on Ethereum prevented the attacker from cashing out at full market value. Analysis by Lookonchain confirmed that the hacker liquidated all 1 billion tokens in a single swap, receiving approximately 108.2 ETH—worth about $237,000 at the time of the transaction. If the bridging asset had been more actively traded, the financial damage could have been significantly higher.
Technical Root Cause
In a preliminary post-mortem, Certik identified the vulnerability as a replay flaw in the calculateRoot function of the Merkle Mountain Range implementation. The function failed to properly bind proofs to requests, allowing the attacker to reuse old state commitments. Downstream, the tokenGateway.handleChangeAdmin function lacked strict input validation, enabling the attacker to arbitrarily supply request data. As a result, malicious code propagated unchecked through the system, ultimately allowing the attacker to change the administrator of the Polkadot token. Certik noted: “The ‘proof’ value submitted by the attacker was copied from the ‘_stateCommitments’ in the previous transaction… thus enabling the replay attack.”
Scope and Remediation
Security experts quickly clarified that the breach was limited to the Hyperbridge gateway on Ethereum. Polkadot’s core relay chain and the native DOT tokens residing on the Polkadot network remained secure and unaffected by the incident. As of this writing, the Hyperbridge development team has not released a full post-mortem report specifically addressing the vulnerability in the gateway smart contract. However, developers are expected to deploy patches to reinforce the security of the managed smart contract functions and prevent similar attacks in the future. Market participants are advised to monitor the situation closely, particularly any official updates from Hyperbridge regarding the upgrade and remediation plan.