1 billion DOTs were minted out of thin air, but the hacker only made 230,000 dollars
Author: Zhou, ChainCatcher
On April 13th at 10 AM Beijing time, the on-chain monitoring platform issued alerts: there was an abnormal issuance of bridged assets on the Ethereum network from Polkadot.
According to analysis by CertiK, the attacker submitted a carefully crafted cross-chain request to the HandlerV1 contract on the Ethereum side through the ISMP protocol of Hyperbridge, along with a historically accepted real MMR proof, successfully bypassing the verification mechanism.
BlockSec Phalcon subsequently released a technical alert, classifying this vulnerability as an MMR proof replay vulnerability. According to their analysis, the root of the vulnerability lies in the fact that the replay protection of the HandlerV1 contract only verifies whether the hash of a certain request has been used before, but the proof verification process does not bind the submitted request payload to the verified proof.
This logical gap allowed the attacker to replay a historically valid proof and pair it with a newly constructed malicious request, thus executing the ChangeAssetAdmin operation through the TokenGateway.onAccept() path, transferring the admin and minting rights of the wrapped DOT contract on Ethereum (address: 0x8d...8F90b8) to an address controlled by the attacker.
According to on-chain data, after obtaining minting rights, the attacker minted 1 billion bridged DOT, which was approximately 2805 times the reported circulating supply of about 356,000 of that token on Ethereum at the time.
Subsequently, the attacker exchanged all chips for about 108.2 ETH through the Odos Router and Uniswap V4 liquidity pool, transferring it to the attacker's external account, realizing a profit of about $237,000 based on the price at that time, with the entire attack consuming only about $0.74 in gas fees.
BlockSec Phalcon also mentioned that there had been a previous attack using the same method, targeting MANTA and CERE tokens, resulting in a loss of about $12,000. The total loss from both attacks amounted to approximately $242,000.
After the incident, leading South Korean exchanges Upbit and Bithumb announced the suspension of deposit and withdrawal services for DOT and AssetHub Polkadot network to prevent potential fake deposit risks.
Polkadot officials stated that this vulnerability only affects DOT bridged to Ethereum via Hyperbridge and does not impact DOT assets within the Polkadot ecosystem or DOT transferred through other cross-chain bridges. Polkadot and its parachains, as well as native DOT, remain secure and unaffected. Currently, Hyperbridge has been suspended to investigate the issue.
It is worth mentioning that although the minting scale reached 1 billion, the actual loss was far lower than the theoretical figure. Due to the extremely limited on-chain liquidity of wrapped DOT on Ethereum, the concentrated sell-off of 1 billion tokens instantly crashed the price of wrapped DOT from $1.22 to $0.00012831, a drop of 99.98%, rendering most tokens ineffective for liquidation.
According to CoinMarketCap data, the price of the native DOT token also briefly dropped nearly 5% due to market sentiment.
Users on X candidly stated that who would have thought the cross-chain myth DOT, which once stood alongside Ethereum, would explode on social media in this way. Cross-chain bridges have once again become the "Achilles' heel" of the crypto world, transforming from a previously neglected area into a scene of devastation. When 1 billion DOT appeared out of nowhere, all technical indicators became worthless.
Some users jokingly remarked that the low liquidity saved Polkadot this time, keeping the actual loss around $237,000.
However, the low liquidity of bridged assets, while limiting the hacker's profits, exposed the potential vulnerabilities of the cross-chain interoperability layer.
It is reported that Hyperbridge, developed by Polytope Labs, is a cross-chain interoperability project within the Polkadot ecosystem, which has long relied on cryptographic proofs instead of multi-signature committees as its core security mechanism, positioning itself as a trust-minimized cross-chain infrastructure. The project had previously emphasized its resistance to common bridge attacks.
But this incident may indicate that the integrity of the cryptographic proof mechanism alone is not sufficient to ensure security; the specific implementation logic of the Gateway contract on the Ethereum side also constitutes an attack surface.
From a broader perspective, this incident reflects the ongoing severe security situation in DeFi since 2026. Several significant attacks have occurred this year, including Venus generating $2.15 million in bad debt due to price manipulation, Resolve over-minting 80 million USR, and Drift being hacked for over $285 million in assets, with various attack methods and a wide range of affected areas.
Taking over minting rights for unlimited issuance is not a new attack model. However, due to the extremely shallow liquidity of Hyperbridge, the losses were unexpectedly minimized.
According to CertiK data, there were 46 recorded security incidents in March alone, with total losses of approximately $39.8 million, marking the highest monthly record since November 2024. CertiK also pointed out that the frequency of code vulnerability exploitation has increased, possibly related to the rise of AI-assisted vulnerability discovery tools.
The rise in attack frequency is also prompting the industry to re-examine the boundaries of security and regulation. Circle's Chief Strategy Officer Dante Disparte previously called for protocols, wallets, exchanges, and stablecoin issuers to view security and accountability as a shared obligation in response to the Drift Protocol theft incident, suggesting that DeFi protocols could develop on-chain technical protection measures referencing traditional market circuit breaker mechanisms and promote relevant legislation to incorporate property rights and financial privacy protection standards into law before the next major incident occurs.
You may also like

Morning Report | BitMine increased its holdings by 126,971 ETH last week; trader Eugene announced his exit from the crypto market

Wang Chuan: How can one not feel anxious after the neighbor Old Wang made thirty times profit by investing in storage stocks? (Seven) - A quarter-century cycle

Cryptocurrency CEXs are flocking to sell US stocks, and traditional brokerages are facing an "uninvited guest."

$75 billion in foreign capital has fled, and South Korean retail investors have absorbed it all using leverage

Japan’s Three Megabanks Plan Joint Stablecoin Issuance in Fiscal 2026
MUFG, SMBC, and Mizuho reportedly plan to jointly issue fiat-pegged stablecoins in fiscal 2026, signaling Japan’s growing push into bank-led digital payment infrastructure.

Humanity Discloses H Token Dual-Chain Attack Details, With Losses on Ethereum and BSC Exceeding $36 Million
Humanity said the H token attack across Ethereum and BSC caused more than $36 million in losses after leaked ProxyAdmin keys enabled malicious contract upgrades and token minting.

White House Discusses CLARITY Act With Law Enforcement Ahead of Senate Vote
The White House discussed the CLARITY Act with law enforcement ahead of a Senate vote, focusing on illicit finance risks and developer protections.

Bitcoin Trading Guide 2026: Strategies for Experienced Traders

What Is XAUT and PAXG? Why Tokenized Gold Is Booming in 2026

Will the SpaceX IPO Hurt Bitcoin? Here's What Traders Are Watching

Foreign selling in the South Korean stock market accelerates, with cumulative net sales reportedly reaching $75 billion this year
On June 9, The Kobeissi Letter, citing Goldman Sachs data, reported that global investors are selling South Korean stocks at an unusually rapid pace. In the latest trading session, foreign investors sold about $801 million worth of Kospi constituent stocks again; total foreign outflows last week reached about $10 billion, and the market has been in net foreign selling on nearly every trading day over the past month. According to the data cited in the report, foreign investors have sold about $75 billion worth of South Korean stocks so far this year. Meanwhile, South Korean retail and institutional investors together recorded roughly $69 billion in net buying over the same period, suggesting that the market’s main buying support has come from domestic capital rather than returning overseas funds. The information currently disclosed still mainly comes from The Kobeissi Letter’s retelling and Goldman Sachs data summaries, while public details on the statistical period and the specific definition of “selling” remain relatively limited.

Fortune Warns of Strategy’s Financing Structure Risks as Bitcoin Premium Narrows
Fortune warned that Strategy’s Bitcoin treasury model faces growing financing risks as MSTR’s net asset premium narrows and preferred stock dividend pressure increases.

Ferrari Challenge Le Mans: Carl Moon to Dominate in WEEX Livery

Sahara AI Responds to SAHARA’s Sharp Drop: No Contract or Product Security Issues Found, Internal Investigation Underway
Sahara AI responded to SAHARA’s 60% price drop, saying no token contract or product security issues have been found and an internal investigation is underway.

WEEX Deposit/Withdrawal Dynamic Island: Your Asset Status, Always in Sight

Scaling Crypto Derivatives: The Digital Asset Infrastructure Behind High-Volume Trading
In the fast-moving digital asset ecosystem, derivatives platforms face an extreme architectural test. High-leverage futures markets demand more than just standard security—they require absolute operational precision, zero-latency matching engines, and ironclad structural scalability, all while navigating intense market volatility.
As global platforms scale to meet these demands, the industry is shifting away from rigid, monolithic setups toward a more agile, "decoupled" infrastructure philosophy.
The Blueprint for High-Volume Copy TradingFor elite global exchanges like WEEX (founded in 2018), this architectural choice becomes critical when scaling high-volume retail features like social copy trading. When thousands of users automatically mirror the real-time strategies of elite traders simultaneously, it triggers sudden, monumental spikes in concurrent transactional volume.
To prevent execution latency or settlement bottlenecks during these peak volatility events, a platform's primary engine must remain entirely dedicated to risk management, copy-trade synchronization, and order matching.
The Architectural Rule: New-generation platforms must separate front-end user execution engines from heavy backend infrastructural overhead to eliminate operational friction.
By separating these layers, platforms can maintain complete sovereignty over their trading environments and user experiences while strategically aligning with institutional-grade infrastructure ecosystems. This strategic framework allows modern exchanges to leverage advanced Digital Asset Custody infrastructure such as Cobo’s behind the scenes, ensuring that backend wallet management scales elastically alongside trading spikes.
Capitalizing on Market Momentum and 400× LeverageIn a derivatives arena where platforms offer up to 400× leverage on perpetual contracts, capital efficiency and market agility are core business metrics. To capture market momentum, an exchange needs the ability to rapidly expand its asset offerings, supporting everything from legacy crypto assets to sudden, trending altcoins across a massive library of trading pairs.
Adopting a flexible, scalable Wallet-as-a-Service (WaaS) solution such as Cobo’s could completely rewrite the development timeline for high-growth exchanges. Instead of spending months of engineering capital building out custom backend wallet architectures for every new blockchain network, platforms can deploy localized infrastructure in days.
This agility allows platforms to instantly scale their listings to over a thousand trading pairs without compromising security or delaying time-to-market. It mirrors the exact operational advantages seen during high-velocity market events, similar to how advanced wallet infrastructure empowers platforms during sudden asset surges; allowing exchanges to pass that speed and liquidity directly to their global user base.
A Mature Foundation for GrowthThe synergy between trusted infrastructure ecosystems and global trading platforms represents the natural evolution of a maturing crypto market. As WEEX continues to scale its global spot and derivatives offerings for over 6 million users, adopting robust backend paradigms proves that platforms no longer have to compromise between cutting-edge trading velocity and uncompromised structural security.

Get Paid to Onboard? Try WEEX’s New Homepage with Rewards for Registration, Deposit & Trade

WEEX Custom Layout: Build Your Perfect Trading Workspace in Seconds
Morning Report | BitMine increased its holdings by 126,971 ETH last week; trader Eugene announced his exit from the crypto market
Wang Chuan: How can one not feel anxious after the neighbor Old Wang made thirty times profit by investing in storage stocks? (Seven) - A quarter-century cycle
Cryptocurrency CEXs are flocking to sell US stocks, and traditional brokerages are facing an "uninvited guest."
$75 billion in foreign capital has fled, and South Korean retail investors have absorbed it all using leverage
Japan’s Three Megabanks Plan Joint Stablecoin Issuance in Fiscal 2026
MUFG, SMBC, and Mizuho reportedly plan to jointly issue fiat-pegged stablecoins in fiscal 2026, signaling Japan’s growing push into bank-led digital payment infrastructure.
Humanity Discloses H Token Dual-Chain Attack Details, With Losses on Ethereum and BSC Exceeding $36 Million
Humanity said the H token attack across Ethereum and BSC caused more than $36 million in losses after leaked ProxyAdmin keys enabled malicious contract upgrades and token minting.
