Attacker Mints 1 Billion Bridged DOT, Sells for 108.2 ETH

An attacker minted 1 billion bridged DOT tokens on Ethereum by exploiting a vulnerability in a Hyperbridge gateway contract, then sold the entire supply in a single transfer for 108.2 ETH (about $237,000).

On-chain records show the sale occurred in one transaction that converted the newly minted bridged DOT into ETH. Blockchain security firm CertiK identified the vulnerability and reported the attacker used a forged cross-chain message to gain administrative control of the DOT token contract deployed on Ethereum.

CertiK’s analysis indicates the forged message allowed the attacker to change the contract’s admin role and trigger a mass mint of the bridged DOT. The exploit targeted the bridge’s message-handling and access controls on the Ethereum side, enabling unauthorized minting.

The incident affected only the bridged, or wrapped, representation of DOT on Ethereum. CertiK and on-chain data indicate Polkadot’s native relay chain and the DOT token on Polkadot were not compromised. At the time of reporting, neither Polkadot nor Hyperbridge had issued an official response.

Bridged tokens are representations of assets from another blockchain. Gateways or bridge contracts verify cross-chain messages and then mint or burn the wrapped token on the destination chain. In this case, a forged message was used to authorize minting on Ethereum, and the attacker immediately sold the tokens on-chain.

Security firms and on-chain monitors are tracking the transaction history and any downstream movement of funds while developers review the gateway contract and assess remediation options. Further technical details, responses from the involved projects, and any recovery steps will be reported as they become available.