Attacker exploits Polkadot-based Hyperbridge to mint 1 billion bridged DOT, nets $237K

Hackers have exploited a vulnerability in the Hyperbridge gateway contract to mint 1 billion unauthorized bridged DOT tokens on Ethereum, according to onchain analysts. Hyperbridge is a cross-chain interoperability protocol built on Polkadot.

Blockchain security firm CertiK reported the exploit targeting the Hyperbridge gateway contract, in which a vulnerability allowed the attacker to forge messages and seize administrative control of the token contract on Ethereum.

The attackers then minted 1 billion DOT (Polkadot) tokens on Ethereum and quickly sold them, profiting approximately $237,000, according to CertiK.

Onchain Lens, a blockchain analysis provider, also flagged the incident, noting that control was swapped to the attacker's contract before the tokens were minted and dumped, sending the price of bridged DOT plunging from $1.22 to "tiny fractions of a cent."

In response to the incident, Polkadot confirmed in a post on X that the exploit only affects DOT on Ethereum bridged through Hyperbridge and does not affect DOT in the Polkadot ecosystem or DOT bridged elsewhere. 

Polkadot added that Hyperbridge has been halted while the issue is being investigated.

While the exploit targeted the bridged DOT tokens on Ethereum rather than the native Polkadot chain, the price of native DOT still fell roughly 4%, dropping to $1.18 from around $1.22 following the incident, according to The Block's crypto price page.

South Korean crypto exchanges Upbit and Bithumb have since temporarily suspended deposits and withdrawals of Polkadot's DOT, citing signs of a security incident, according to official notices. 

The Block has reached out to Hyperbridge for comment.

This is a developing story.