Bridge exploit mints 1B tokens on Ethereum

TLDR

A bridge vulnerability on Ethereum let an attacker mint about 1 billion fake Polkadot (DOT) tokens, but actual losses were only around 108 ETH due to thin liquidity.

1. The exploit hit Hyperbridges Ethereum gateway for bridged DOT, not Polkadots native chain, by forging a cross chain message to gain admin control and mint 1 billion tokens.
2. Despite a notional value above 1 billion dollars, the attacker could only dump enough into shallow pools to extract roughly 237,000 dollars before the price collapsed.
3. The incident highlights cross chain bridges as a structural weak point and puts scrutiny on Hyperbridges proof verification and admin controls, with paused operations and investigations ongoing.

Deep Dive

1. What Actually Got Exploited

Reports show the attack targeted Hyperbridge, a cross chain gateway that issues an ERC 20 version of DOT on Ethereum, not Polkadots native relay chain or on chain DOT itself. An attacker used a forged cross chain message that bypassed state proof validation on Hyperbridges Ethereum gateway contract, seizing admin rights over the bridged DOT token and minting 1 billion tokens in a single transaction. Outlets like CoinDesk describe this as a classic infinite mint bug in the bridge contract, not a consensus failure on Polkadots base layer.

2. Why Losses Stayed Relatively Small

On paper the 1 billion minted DOT on Ethereum were worth over 1.1 billion dollars at recent prices, yet the attacker realized only about 108.2 ETH, roughly 237,000 dollars, before liquidity ran out. Because Ethereum side DOT pools were shallow, dumping such a huge synthetic supply instantly crushed the bridged tokens price, limiting profit to a fraction of a cent per token. Several reports note that the small loss is largely an accident of low liquidity, not good security design.

3. Bridge Risk And What To Watch

Analyses from multiple security firms and news outlets stress that the root cause is a flaw in Hyperbridges proof verification logic and centralized admin control over the destination token contract. Hyperbridge has paused activity while it investigates, and some exchanges temporarily halted DOT flows to reduce confusion between bridged and native assets. Going forward, key things to watch are: a detailed post mortem from Hyperbridge, patches to verification and admin paths, and audits or changes for other tokens using the same bridge stack.

Conclusion

The 1 billion token mint on Ethereum was a severe Hyperbridge contract failure, not a Polkadot chain failure, and low liquidity kept the direct theft relatively small. Even so, it reinforces a clear pattern in crypto that the weakest links are often bridges controlling wrapped assets on other chains, not the base networks themselves.