Polkadot-Ethereum Bridge Exploit Turned Out 10x Worse Than First Reported — Hyperbridge Revises Losses to ~$2.5M
What began as a seemingly modest bridge exploit has ballooned into a multimillion-dollar incident. Hyperbridge now says the attack that minted 1 billion wrapped DOT tokens and drained escrowed assets was far larger than the initial $237,000 loss estimate — the true realized loss is roughly $2.5 million.
How the attack unfolded
- The attacker exploited a flaw in the Merkle Mountain Range (MMR) proof verification logic used by Hyperbridge’s Token Gateway. That vulnerability allowed a forged cross-chain message to bypass verification and mint bridged DOT on Ethereum.
- The incident appears to have been two-phased. Hours before the mass minting, a related smart contract was drained for about 245 ETH (roughly $561,000 at the time). Then, a fraudulent message allowed the attacker to mint 1 billion bridged DOT and sell them into very thin liquidity, causing the observable sell-off worth about $237,000.
- Contrary to Hyperbridge’s initial account, the attacker impacted four chains — Ethereum, Base, Arbitrum and BNB Chain — not just bridged DOT on Ethereum. After reconciling activity across chains and factoring in incentive-pool losses, Hyperbridge’s revised total is ~ $2.5M (denominated in ETH and DOT at time of the exploit).
Funds traced to Binance; recovery likely months away
Hyperbridge says the stolen funds were traced to a deposit address on Binance. The team has engaged Binance’s compliance unit and relevant law enforcement, but cautions that meaningful recovery — if possible — will likely take months and could stretch to a year.
Compensation plans and token constraints
Hyperbridge says it aims to make affected users whole. If direct recovery falls short, the protocol will allocate BRIDGE tokens in a “structured” program to cover residual losses. That option is complicated by BRIDGE’s low liquidity: CoinGecko data shows only about $1,800 traded over 24 hours and a market cap near $858,000 at a price around $0.006 on March 29 — roughly one-third of the revised loss figure.
Bridges paused; patch and audits required
Bridging activity across the four affected chains remains paused. Hyperbridge says functionality will only be restored after a patch is deployed and audited. The team reaffirmed faith in cross-chain cryptographic proofs but emphasized that the exploit exposed weaknesses in verification logic and the need for more frequent audits and adversarial testing at every protocol layer.
Why this matters
The incident highlights persistent, systemic risks in cross-chain infrastructure: subtle verification logic bugs can enable destructive forged messages, and low-liquidity bridged assets can be weaponized to amplify losses. As bridges proliferate, this case reinforces calls for tighter formal verification, deeper adversarial reviews, and stronger incident-response channels with exchanges and law enforcement.
Hyperbridge’s full postmortem is available from the team; they say they will continue investigations and updates as recovery efforts proceed.
Read more AI-generated news on: undefined/news
