Crypto Hacker Mints $1.1 Billion in Polkadot through Ethereum Bridge, However Can Solely Money Out $237K – Decrypt

A technical exploit of blockchain token bridge Hyperbridge led to the unreal creation of 1 billion Polkadot (DOT) tokens valued above $1.1 billion—nevertheless it solely noticed round $237,000 in losses attributable to restricted liquidity, the agency reported on Monday. 

The protocol, which permits customers to switch funds to and from distinct blockchains—like Ethereum to Polkdaot—stated the exploit was because of a vulnerability in its proof verification logic. The malicious actor has not but been recognized. 

“This flaw allowed invalid proofs to be incorrectly accepted as legitimate,” Hyperbridge posted on X. “Consequently, a malicious message was processed that granted the attacker administrative management of the bridged DOT token contract on Ethereum.” 

As soon as the exploiter gained entry to the bridged DOT token contract, they proceeded to mint 1 billion bridged DOT tokens—which exceeded the precise bridged DOT token provide by round 2,800 instances. For reference, the entire native, non-bridged DOT provide is only one.6 billion tokens.

The agency and the staff behind the Polkadot blockchain confirmed the exploit was confined to solely bridged DOT on the Ethereum blockchain.

After minting the tokens, the attacker then bought them instantly on decentralized exchanges, making away with round $237,000—the quantity that was accessible in buying and selling liquidity.

Ought to there have been ample liquidity, somebody with round 1 billion DOT tokens might stand to achieve greater than $1 billion because the token trades round $1.17, down 4.6% within the final 24 hours.

At that mark, DOT has now fallen greater than 68% within the final yr of buying and selling and is almost 98% off its November 2021 all-time excessive of $54.98. DOT is at the moment simply above its all-time low value of $1.15, set in February.

The protocol’s app is down for upkeep because it provides “extra safeguards” and works with safety companions in an try and get better swiped funds. 

Bridge protocols have been on the middle of a number of exploits through the years, highlighted by Ronin Community’s $552 million exploit in 2022 when hackers attacked its native bridge to Ethereum. The exploit stays one of many largest crypto hacks of all-time, and was linked by U.S. authorities businesses to North Korea’s notorious state-sponsored Lazarus hacking group.

The newest exploit provides to a mounting record of considerations surrounding the safety of DeFi protocols, following the current exploit of Solana’s Drift Protocol, which misplaced greater than $285 million on April 1 to a North Korean-linked hacker.