1 billion DOTs were minted out of thin air, but the hacker only made 230,000 dollars
Author: Zhou, ChainCatcher
On April 13th at 10 AM Beijing time, the on-chain monitoring platform issued alerts: there was an abnormal issuance of bridged assets on the Ethereum network from Polkadot.
According to analysis by CertiK, the attacker submitted a carefully crafted cross-chain request to the HandlerV1 contract on the Ethereum side through the ISMP protocol of Hyperbridge, along with a historically accepted real MMR proof, successfully bypassing the verification mechanism.
BlockSec Phalcon subsequently released a technical alert, classifying this vulnerability as an MMR proof replay vulnerability. According to their analysis, the root of the vulnerability lies in the fact that the replay protection of the HandlerV1 contract only verifies whether the hash of a certain request has been used before, but the proof verification process does not bind the submitted request payload to the verified proof.
This logical gap allowed the attacker to replay a historically valid proof and pair it with a newly constructed malicious request, thus executing the ChangeAssetAdmin operation through the TokenGateway.onAccept() path, transferring the admin and minting rights of the wrapped DOT contract on Ethereum (address: 0x8d...8F90b8) to an address controlled by the attacker.
According to on-chain data, after obtaining minting rights, the attacker minted 1 billion bridged DOT, which was approximately 2805 times the reported circulating supply of about 356,000 of that token on Ethereum at the time.
Subsequently, the attacker exchanged all chips for about 108.2 ETH through the Odos Router and Uniswap V4 liquidity pool, transferring it to the attacker's external account, realizing a profit of about $237,000 based on the price at that time, with the entire attack consuming only about $0.74 in gas fees.
BlockSec Phalcon also mentioned that there had been a previous attack using the same method, targeting MANTA and CERE tokens, resulting in a loss of about $12,000. The total loss from both attacks amounted to approximately $242,000.
After the incident, leading South Korean exchanges Upbit and Bithumb announced the suspension of deposit and withdrawal services for DOT and AssetHub Polkadot network to prevent potential fake deposit risks.
Polkadot officials stated that this vulnerability only affects DOT bridged to Ethereum via Hyperbridge and does not impact DOT assets within the Polkadot ecosystem or DOT transferred through other cross-chain bridges. Polkadot and its parachains, as well as native DOT, remain secure and unaffected. Currently, Hyperbridge has been suspended to investigate the issue.
It is worth mentioning that although the minting scale reached 1 billion, the actual loss was far lower than the theoretical figure. Due to the extremely limited on-chain liquidity of wrapped DOT on Ethereum, the concentrated sell-off of 1 billion tokens instantly crashed the price of wrapped DOT from $1.22 to $0.00012831, a drop of 99.98%, rendering most tokens ineffective for liquidation.
According to CoinMarketCap data, the price of the native DOT token also briefly dropped nearly 5% due to market sentiment.
Users on X candidly stated that who would have thought the cross-chain myth DOT, which once stood alongside Ethereum, would explode on social media in this way. Cross-chain bridges have once again become the "Achilles' heel" of the crypto world, transforming from a previously neglected area into a scene of devastation. When 1 billion DOT appeared out of nowhere, all technical indicators became worthless.
Some users jokingly remarked that the low liquidity saved Polkadot this time, keeping the actual loss around $237,000.
However, the low liquidity of bridged assets, while limiting the hacker's profits, exposed the potential vulnerabilities of the cross-chain interoperability layer.
It is reported that Hyperbridge, developed by Polytope Labs, is a cross-chain interoperability project within the Polkadot ecosystem, which has long relied on cryptographic proofs instead of multi-signature committees as its core security mechanism, positioning itself as a trust-minimized cross-chain infrastructure. The project had previously emphasized its resistance to common bridge attacks.
But this incident may indicate that the integrity of the cryptographic proof mechanism alone is not sufficient to ensure security; the specific implementation logic of the Gateway contract on the Ethereum side also constitutes an attack surface.
From a broader perspective, this incident reflects the ongoing severe security situation in DeFi since 2026. Several significant attacks have occurred this year, including Venus generating $2.15 million in bad debt due to price manipulation, Resolve over-minting 80 million USR, and Drift being hacked for over $285 million in assets, with various attack methods and a wide range of affected areas.
Taking over minting rights for unlimited issuance is not a new attack model. However, due to the extremely shallow liquidity of Hyperbridge, the losses were unexpectedly minimized.
According to CertiK data, there were 46 recorded security incidents in March alone, with total losses of approximately $39.8 million, marking the highest monthly record since November 2024. CertiK also pointed out that the frequency of code vulnerability exploitation has increased, possibly related to the rise of AI-assisted vulnerability discovery tools.
The rise in attack frequency is also prompting the industry to re-examine the boundaries of security and regulation. Circle's Chief Strategy Officer Dante Disparte previously called for protocols, wallets, exchanges, and stablecoin issuers to view security and accountability as a shared obligation in response to the Drift Protocol theft incident, suggesting that DeFi protocols could develop on-chain technical protection measures referencing traditional market circuit breaker mechanisms and promote relevant legislation to incorporate property rights and financial privacy protection standards into law before the next major incident occurs.
You may also like

a16z New Article: Predictive Markets Entering Fast-Forward Phase

a16z founder: In the age of Agents, what truly matters has changed

The President of Kyrgyzstan meets with Sun Yuchen, and TRON collaborates with Kyrgyzstan to build a new pattern of digital economy in Central Asia

46 minutes, $292 million stolen, DeFi faces development dilemma again

How to Earn Free USDT in 2026: No High Volume Required (WEEX Poker Party Guide)
Is Joker Crypto legit in 2026 or just another memecoin? Can You Really Earn Passive Income with Joker Crypto in 2026? Learn how Joker staking rewards work, how to earn NFT bonuses, expected APY ranges, gas-fee rebates, and how to avoid crypto scams before joining.
How to Get Free USDT Welcome Bonus in 2026: Earn Up to 700 USDT on WEEX
Legit Free Welcome Bonus 2026: Learn how to earn up to 700 USDT on WEEX with Auto Earn Boost Fest. Increase your balance, activate Auto Earn, and qualify automatically.

AI Agent Payments Just Got Real: Utexo × x402 Brings 50ms USDT Transactions to Internet Scale
Utexo integrates USDT into the x402 protocol, enabling 50ms instant payments embedded natively in HTTP requests. Explore how this breakthrough is rewriting the rules for AI agent payments, API monetization, and the machine-to-machine economy.

DWF Deep Report: AI in DeFi Outperforms Humans in Yield Optimization, but Complex Trades Still Lag Behind by 5 Times

What Separates Smart Money from the Crowd in Crypto? Insights from Freedom of Money
Most crypto traders lose money not because of bad luck, but because they misunderstand how the market really works. From Freedom of Money to the rise and fall of Sam Bankman-Fried, they highlight a key divide in crypto: those who build the market and those who chase it. This reading guide explores essential books that reveal how narrative, regulation, capital, and psychology shape long-term success in the crypto industry.

The Risk Management Core Team has just been ousted, and Aave is now facing a $200 million default.

The $293 million bug wasn't in the code; so, what's the deal with the "DVN Configuration Bug," which led to the largest hack of 2026?

a16z on Recruitment: How to Choose Between Crypto-Native and Traditional Talent?

The biggest DeFi heist of 2026, hackers easily took advantage of Aave

Will Robots Replace Humans? He Says No!

Binance Coin's Price Skyrockets 15x to All-Time High, Saved by Three Bull Market Lifelines

The organization has accessed the prediction market, but is stuck at the third stage

Head of crypto VC collective shrinks: a16z crypto fund management scale plummets by 40%, Multicoin cut in half

Arthur Hayes New Post: It's "No Trade" Time Now
a16z New Article: Predictive Markets Entering Fast-Forward Phase
a16z founder: In the age of Agents, what truly matters has changed
The President of Kyrgyzstan meets with Sun Yuchen, and TRON collaborates with Kyrgyzstan to build a new pattern of digital economy in Central Asia
46 minutes, $292 million stolen, DeFi faces development dilemma again
How to Earn Free USDT in 2026: No High Volume Required (WEEX Poker Party Guide)
Is Joker Crypto legit in 2026 or just another memecoin? Can You Really Earn Passive Income with Joker Crypto in 2026? Learn how Joker staking rewards work, how to earn NFT bonuses, expected APY ranges, gas-fee rebates, and how to avoid crypto scams before joining.
How to Get Free USDT Welcome Bonus in 2026: Earn Up to 700 USDT on WEEX
Legit Free Welcome Bonus 2026: Learn how to earn up to 700 USDT on WEEX with Auto Earn Boost Fest. Increase your balance, activate Auto Earn, and qualify automatically.

