Security firm BlockSec reported that an attacker exploited a proof verification flaw in Hyperbridge‘s Token Gateway, causing approximately $237,000 in losses. The attacker forged invalid proofs to gain administrative control, minting 1 billion fake bridged DOT tokens and selling them before the system was paused. The incident affected only bridged DOT on Ethereum, leaving native Polkadot assets unharmed.
A major security incident has hit the Hyperbridge network after attackers exploited a vulnerability in its Token Gateway system. The exploit led to about $237,000 in losses on Ethereum.
Hyperbridge immediately paused all bridging operations after detecting the attack. The team confirmed the issue only affected bridged DOT on Ethereum.
Researchers from BlockSec Phalcon reported the problem came from a weakness in the platform’s Solidity-based Merkle Mountain Range proof verification logic. The system failed to properly validate inputs inside the VerifyProof function.
This design flaw allowed the attacker to trick the system into accepting fake verification data. The attacker gained unauthorized administrative control over the bridged DOT token contract.
After successfully gaining control, the attacker minted 1 billion bridged DOT tokens. This amount was more than 2,800 times the real circulating supply.
The attacker then sold a large portion of these tokens on decentralized exchanges, causing market disruption. Hyperbridge later confirmed native DOT on the Polkadot relay chain was not affected.
So far, Hyperbridge has paused all bridging activity while investigations continue. The team is working with security partners to trace and possibly recover the stolen funds.
