Polkadot Bridge Exploit Lets Attacker Mint and Sell 1 Billion DOT Tokens

Highlights:

• Hyperbridge exploit lets attacker mint one billion fake DOT and dump them on Ethereum.
• Polkadot’s main network stayed safe, while only the bridged DOT on Ethereum was affected.
• CertiK flagged the breach after the attacker converted fake tokens into about 108 ETH.

A cross-chain bridge connected to Polkadot suffered a security breach on Monday, allowing an attacker to create one billion DOT tokens without permission and sell them quickly on Ethereum. Blockchain security firm CertiK detected the exploit and shared details about the incident. The attack targeted Hyperbridge, a Polkadot-based interoperability tool, not the main Polkadot network itself. 

Advertisement

#CertiKInsight 🚨

We have seen an exploit on the @hyperbridge gateway contract. https://t.co/h27iDm1JGd

The attacker slipped through a forged message to change the admin of Polkadot token contract on Ethereum and profited ~$237K from minting and selling 1B tokens.

Stay… pic.twitter.com/3t2n4uq5hy

— CertiK Alert (@CertiKAlert) April 13, 2026

How the Attack Unfolded

Hyperbridge is a tool that helps tokens move between different blockchains. The attacker took control by sending a fake message to Hyperbridge’s gateway contract. This fake message changed the admin control of the DOT token contract on Ethereum. 

After getting that control, the attacker created 1 billion DOT tokens without permission and sold them through decentralized exchanges. On-chain data shows the whole attack happened in about one hour. In the end, the attacker turned the fake tokens into about $237,000 worth of Ethereum. 

The 1 billion DOT number looks very big, but the attacker did not make that much money. This happened because there was not enough buying demand on Ethereum. When someone sells a huge amount of tokens in a small market, the price falls very fast. So even though the attacker created 1 billion fake DOT, they could only get around 108.2 ETH, worth about $237,000 at the time.

Main Polkadot Network Stayed Safe

Polkadot’s main blockchain stayed safe during this attack. The problem only affected the wrapped DOT token on Ethereum, not the real DOT on Polkadot. So people holding DOT on the main Polkadot network did not directly lose their funds from this incident. But the attack still shows an important risk.

Cross-chain bridges help move tokens from one blockchain to another, but they can also become weak points for hackers. Hyperbridge is one of these tools. It facilitates the connection between different blockchain networks, sharing information through secure validation processes. However, when a bridge contract is attacked, hackers may create duplicate coins or steal money from users’ wallets. This is precisely what occurred in the current scenario.

No Official Response Yet from Polkadot

Neither Polkadot nor Hyperbridge issued an official statement when this was reported. The teams will likely look into the incident, fix the vulnerability, try to recover funds, and then update users.

Holders of the bridged DOT token on Ethereum should stay away from trading it until the team completely resolves the issue. Users who hold native DOT on the Polkadot network do not need to act quickly, as the exploit did not impact their assets.

Polkadot’s DOT fell from $1.23 to $1.17 after news of the attack broke, according to CoinMarketCap. Its market cap also dropped 3.45% to $1.99 billion.

Advertisement