<h2 id="header-0">Key Facts</h2>
<ul>
 <li>Parity said a bug in the XCM executor on Polkadot Asset Hub was used between Oct. 24 and 26 to cut dotUSD's recorded issuance without changing account balances, distorting pricing in a DOT/dotUSD pool.</li>
 <li>The estimated loss was about $1.381 million in DOT value, borne by the Polkadot Treasury as the pool's only liquidity provider, and no users lost funds.</li>
 <li>The bug was reported through Parity's bug bounty program in June and fixed in the codebase, but the fix missed a release cut-off and was not in the affected production runtimes.</li>
</ul>
The Polkadot (<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/currencies/polkadot-new/">DOT</a>) Treasury lost an estimated $1.38 million in DOT after an attacker exploited a bug that had been fixed in the codebase in June but had not reached the affected production runtimes, according to a Parity incident review.
No users lost funds, Parity said. The Treasury was the pool's only <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/liquidity-provider">liquidity provider</a>.
"Although the vulnerability was identified and a fix merged in June, that fix had not reached the affected production runtimes," Parity said in its <a target="_blank" rel="noopener noreferrer nofollow" href="https://forum.polkadot.network/t/xcm-incident-review-what-happened-and-what-we-learned/19207">review</a> on the Polkadot forum.<img src="https://academy-public.coinmarketcap.com/optimized-uploads/4f53b1ec706a4b3fab2e5f4c23351ddd.png">
Parity said an XCM bug cost the Polkadot Treasury about $1.38 million in DOT. Source: <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/currencies/polkadot-new/">CoinMarketCap</a>
<h2 id="header-1">How the XCM Bug Was Exploited</h2>
Between Oct. 24 and 26, a bug in the XCM executor on Polkadot Asset Hub was used to reduce the recorded issuance of dotUSD without changing account balances, Parity said. XCM programs are meant to undo all state changes when they fail, but the bug left the change to recorded supply in place.
dotUSD is one of the DOT-backed stablecoins a recent <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/article/polkadot-dao-strategy-mandate-dotstables-proposal">OpenGov referendum sought to prioritize</a>. The Hub's <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/decentralized-exchange-dex">decentralized exchange</a> used the lower of the pool's balance and dotUSD's recorded supply to cap how much dotUSD it treated as available. Once reported supply fell below the pool's balance, pricing was distorted, allowing dotUSD to be swapped for DOT at an artificial rate. dotUSD stayed fully backed, though the understated supply restricted redemption until corrected, Parity said.
The attacker's messages arrived from Ethereum through Snowbridge, but the underlying <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/bug-exploit">bug</a> was in the XCM executor, not the bridge, Parity said. On-chain evidence has not established that the attacker who exploited the bug also profited from the resulting arbitrage, it said.
<h2 id="header-2">Why the June Fix Wasn't Live</h2>
The bug was reported through Parity's bug bounty program in June and classified as medium severity, before dotUSD launched. The fix missed the stable-2606 release cut-off and was later included in stable-2609, Parity said. It has since been reclassified as critical.
Parity said it found a public forum comment on Oct. 20 in which the researcher who reported the bug referenced the fix, breaching the program's terms, and that the comment "may have provided attackers with sufficient context" to exploit it.
Runtime 2.5.1, containing the fix, was proposed through OpenGov on Oct. 24, as Snowfork halted its relayers and paused the attack. The attacker resumed on Oct. 26 using its own relayer, about six hours before the upgrade was applied. Runtime 2.5.2, enacted on Oct. 30, corrected dotUSD's recorded supply, and recovered dotUSD was returned to the Treasury.
Parity said it will speed up how fixes reach production. The incident follows Polkadot's October warning that the <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/article/fearless-wallet-extension-leaked-private-keys-polkadot">Fearless Wallet extension had leaked private keys</a>.
Read More:&nbsp;<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/article/bitcoin-core-security-policy-ai-easy-bugs">Bitcoin Core Will Fast-Track Fixes for Bugs AI Can Easily Find</a>

Polkadot Treasury Lost $1.38M After XCM Fix Missed Production Release

Table of Contents

Other articles published on Nov 4, 2026

Join our free newsletter for daily crypto updates!