Polkadot: a bug causes the project to lose nearly $1.4 million in cash

Home » Crypto news » Altcoins news » Polkadot: a bug causes the project to lose nearly $1.4 million in treasury

https://cryptoast.fr/polkadot-bug-xcm-dotusd-tresorerie-perd-1-4-million-dollars/

Between October 24 and 26, 2026, an attacker exploited a vulnerability in the Cross-Consensus Messaging (XCM) executor of Asset Hub, Polkadot's asset-focused parachain, which hosts a decentralized exchange (DEX). Following the exploitation of this vulnerability, approximately $1.38 million in DOT was siphoned from the DOT/dotUSD pool, of which the project treasury was then the sole liquidity provider.

The bug affected a specific instruction, “WithdrawAsset”. When an XCM program failed, the debits on the accounts were canceled, but the drop in the total supply of dotUSD recorded by the blockchain was preserved. By repeating the operation, the attacker artificially caused the official supply of the Polkadot stablecoin to fall, without the users' real balances changing.

But the problem is that, to calculate the price, the Asset Hub DEX's DOT/dotUSD pool took the smaller of two values, its own dotUSD balance or the official supply of the asset. Once this offer fell below the actual pool balance, the pool began to significantly overvalue dotUSD. It became possible to exchange dotUSD for much more DOT than it was worth, at the expense of Polkadot's treasury.

It should be noted, however, that the available on-chain evidence has not established that the attacker behind the exploitation of the XCM vulnerability is also the one who took advantage of the arbitrage that followed on the DOT/dotUSD pool. In other words, the person who triggered the breach and the person who received the profits from the distorted price could potentially be two separate entities.

A technical point deserves to be clarified on the attack vector. The XCM messages exploiting the flaw were actually arriving from Ethereum (ETH), via Snowbridge, the decentralized bridge that connects Ethereum to the Polkadot Asset Hub. The Parity teams, who develop the DOT network, however insisted on one point: the underlying bug was in the XCM executor, not in Snowbridge, and they also reproduced the behavior without using the bridge.

This detail, however, explains why the initial response came from Snowfork, the operator of Snowbridge. As of October 24, Snowfork shut down its own relayers, these programs which transmit the state of the Ethereum consensus to Polkadot. Without these updates, the bridge could no longer accept new messages, and the attack was temporarily blocked. Two days later, however, the attacker got around the obstacle by running his own relay.

Machine-translated from French