Certik reported a significant exploit of the Hyperbridge gateway, allowing an attacker to mint 1 billion unauthorized Polkadot (DOT) tokens on the Ethereum network.
Key Takeaways
- A hacker exploited a replay vulnerability in the Hyperbridge gateway to mint 1 billion fake DOT tokens on Ethereum.
- The price of DOT dropped 6% from $1.23 to $1.16 before partially recovering to $1.19.
- The attacker swapped the entire fake token supply for 108.2 ETH (~$237,000) due to shallow liquidity of the bridged asset.
- The exploit was limited to the Ethereum bridge; Polkadot's native relay chain and authentic DOT remained secure.
Exploit Mechanics: Fabricated Messages and Admin Privilege Escalation
On April 13, 2026, security researchers from Certik alerted the crypto community to an ongoing attack on the Hyperbridge gateway, a cross-chain bridge connecting Polkadot and Ethereum. According to on-chain data, the attacker first identified a flaw in the gateway's smart contract logic. By submitting a fabricated message, they gained administrative control over the bridged DOT contract on Ethereum. This allowed them to execute a single transaction that created 1 billion counterfeit DOT tokens.
The minting itself was not the financial windfall the attacker might have hoped for. Because the bridged DOT token on Ethereum had extremely limited liquidity — being a wrapped version rather than the native network token — the hacker was forced to dump the entire supply in one swap. Analysis by Lookonchain shows the attacker received approximately 108.2 ETH, worth roughly $237,000 at the time of the transaction. Had the bridged asset been more widely traded, the impact could have been far more severe.
Root Cause: Merkle Mountain Range Replay Vulnerability
Certik's initial post-mortem traced the exploit to a replay vulnerability in the Merkle Mountain Range (MMR) calculateroot function. This function failed to properly bind proofs to specific requests, allowing old state commitments to be reused. Downstream, the tokengateway.handlechangeadmin function did not enforce strict input validation, enabling the attacker to arbitrarily pass request data. As a result, malicious code propagated unchecked through the system, ultimately permitting the admin change of the Polkadot token contract.
Certik explained, "The attacker submitted a 'proof' value copied from the '_stateCommitments' in a previous transaction, thus making the replay possible." Hyperbridge developers have not yet published a full post-mortem, but patches are expected to be deployed soon to secure administrative smart contract functions.
Market Reaction and Network Security
The news triggered an immediate selloff in DOT, which dropped from $1.23 to $1.16 within minutes — a 6% decline. However, the price quickly rebounded to $1.19 as traders realized the exploit was isolated to the Ethereum bridge and did not affect the Polkadot relay chain or native DOT tokens. Security experts from multiple firms confirmed that the core Polkadot network remained fully secure, and no unauthorized tokens were created on the relay chain itself.
This incident highlights the persistent risks associated with cross-chain bridges, particularly those relying on complex verification logic. While shallow liquidity limited the financial damage in this case, the vulnerability itself underscores the need for rigorous smart contract audits and formal verification of bridge protocols. For DOT holders, the safest custody remains on the native Polkadot network, while users interacting with bridged assets on Ethereum should monitor for patches before deploying additional funds.