SubQuery Network

Hyperbridge

Polkadot

A hacker exploited the Polkadot-based cross-chain interoperability protocol Hyperbridge, netting about $237,000 and raising renewed security concerns about blockchain bridge infrastructure.
An attacker minted 1 billion bridged Polkadot (<a href="https://cointelegraph.com/price-indexes/polkadot" rel="noopener noreferrer nofollow">DOT</a>) tokens in a single transaction on Hyperbridge, according to blockchain <a href="https://skylens.certik.com/tx/eth/0x240aeb9a8b2aabf64ed8e1e480d3e7be140cf530dc1e5606cb16671029401109" rel="noopener noreferrer nofollow">data</a> shared by cybersecurity platform CertiK. The exploit only affected DOT on Ethereum that was bridged through Hyperbridge, while native DOT tokens and the wider Polkadot ecosystem remain unaffected, Polkadot noted in a Monday X <a href="https://x.com/Polkadot/status/2043594321836884446" rel="noopener noreferrer nofollow">post</a>.
CertiK <a href="https://x.com/CertiKAlert/status/2043557571609731268" rel="noopener noreferrer nofollow">said</a> the attacker managed to mint the tokens after “slipping through a forged message to change the admin of the Polkadot token contract on Ethereum.” Limited liquidity in the bridged DOT pool capped the proceeds at 108.2 Ether (<a rel="noopener noreferrer nofollow">ETH</a>), worth around $237,000.
<h2 id="hyperbridge-pauses-operations-after-exploit">Hyperbridge pauses operations after exploit</h2>
Hyperbridge paused operations after the attack while the team worked on an upgrade, with contributor Web3 Philosopher <a href="https://x.com/seunlanlege/status/2043571976673845579" rel="noopener noreferrer nofollow">saying</a> the initial diagnosis pointed to a malicious proof that fooled the protocol’s Merkle tree verifier.
The exploit is notable because Hyperbridge has <a href="https://wiki.polkadot.com/learn/learn-hyperbridge/" rel="noopener noreferrer nofollow">marketed</a> itself as a proof-based interoperability layer built to <a href="https://blog.polytope.technology/introducing-hyperbridge-interoperability-coprocessor#full-node-level-security" rel="noopener noreferrer nofollow">deliver</a> “full node security” for crosschain bridges. The incident also follows Aethir’s disclosure last week that it had <a href="https://cointelegraph.com/news/aethir-bridge-exploit-halt-user-compensation-90k-loss" rel="noopener noreferrer nofollow">contained a separate bridge exploit</a> and kept user losses below $90,000.
Cybersecurity research company Blocksec Falcon <a href="https://x.com/Phalcon_xyz/status/2043567998662053982" rel="noopener noreferrer nofollow">said</a> the likely root cause of the exploit was a Merkle Mountain Range (MMR) proof replay vulnerability caused by missing proof-to-request binding, though the final root cause has not yet been confirmed by the protocol.
<figure><img src="https://s3.cointelegraph.com/uploads/2026-04/019d85e9-a524-7eb9-b129-3ebc5189bdff.png" alt="Hyperbridge attacker mints 1B bridged Polkadot tokens in $237K exploit">
 <figcaption>Source: <a href="https://x.com/CertiKAlert/status/2043557571609731268/photo/1" rel="noopener noreferrer nofollow">CertiK</a>
 </figcaption>
</figure>
The native DOT token briefly dipped to a daily low of $1.16 on Monday, before recovering to trade above $1.19 at the time of writing, <a href="https://www.coingecko.com/en/coins/polkadot" rel="noopener noreferrer nofollow">according</a> to CoinGecko.
<figure><img alt="Hackers, Cybercrime, Cybersecurity, Scams, Hacks, Polkadot" src="https://s3.cointelegraph.com/uploads/2026-04/019d8617-1719-7467-865d-ca53e8f9129e.png">
 <figcaption>DOT/USD, 24-hour chart. Source: CoinGecko
 </figcaption>
</figure>
<h2 id="hackers-exploit-subquery-network-for-130-000">Hackers exploit SubQuery network for $130,000</h2>
Security incidents continue to hit crypto protocols despite a sharp year-over-year drop in DeFi exploit losses.
Related: <a href="https://cointelegraph.com/news/ai-cybercrime-tool-crypto-bank-kyc-deepfakes" rel="noopener noreferrer nofollow">New AI cybercrime tool targets crypto, bank KYC systems via deepfakes</a>
On Sunday, the data indexing protocol SubQuery Network was also exploited for around $130,000 due to missing access control data that exposed the code written over two years ago.
The vulnerability enabled the attacker to set their own contract as the withdrawal target for staking rewards, blockchain security auditor Pashov said in a Sunday X <a href="https://x.com/pashov/status/2043354433686237679/photo/1" rel="noopener noreferrer nofollow">post</a>.
<figure><img src="https://s3.cointelegraph.com/uploads/2026-04/019d85e9-a6f7-70f2-b166-031ce2f5f3b7.png" alt="Hyperbridge attacker mints 1B bridged Polkadot tokens in $237K exploit">
 <figcaption>Source: <a href="https://x.com/pashov/status/2043354433686237679/photo/1" rel="noopener noreferrer nofollow">Pashov</a>
 </figcaption>
</figure>
<a href="https://cointelegraph.com/news/defi-hacks-169m-q1-2026-crypto-exploits-decline" rel="noopener noreferrer nofollow">Hackers stole over</a> $168 million from 34 decentralized finance (DeFi) protocols in the first quarter of 2026, marking a significant decline from the $1.58 billion stolen in the first quarter of 2025, when the record <a href="https://cointelegraph.com/news/lazarus-group-2024-pause-repositioning-1-4-b-bybit-hack" rel="noopener noreferrer nofollow">$1.4 billion Bybit</a> hack occurred.
Cointelegraph has contacted Hyperbridge for comment on the root cause of the exploit.<iframe src="https://www.youtube.com/embed/NDv0RfehETQ?start=" sandbox="allow-scripts allow-same-origin allow-popups allow-forms"></iframe>
Magazine: <a href="https://cointelegraph.com/magazine/meet-crypto-sleuths-fighting-crime-better-than-the-cops/" rel="noopener noreferrer nofollow">Meet the onchain crypto detectives fighting crime better than the cops</a>

Hyperbridge attacker mints 1B bridged Polkadot tokens in $237K exploit

Table of Contents

Cointelegraph

Other articles published on Apr 13, 2026

Join our free newsletter for daily crypto updates!