Polkadot's Treasury lost $1.38 million after an attacker exploited a vulnerability that developers had corrected four months earlier. Parity Technologies disclosed in a November 2 incident report that the June code fix had not reached affected production systems before the October 24-26 attack. Parity develops blockchain infrastructure for the Polkadot and Kusama ecosystems.
The attacker altered supply records through Polkadot Asset Hub's cross-chain messaging system, reducing dotUSD's recorded supply while leaving users' token balances unchanged. The mismatch disrupted pricing in the DOT/dotUSD liquidity pool, enabling traders to obtain DOT for dotUSD at artificially distorted rates. The Treasury bore approximately $1.381 million in losses as the pool's only liquidity provider. Parity said users suffered no loss of funds and dotUSD retained full backing in USDT. However, Parity could not determine whether the exploiter also benefited from the arbitrage trades that followed.
dotUSD, Polkadot's decentralized stablecoin, began operating in October under the network's decentralized autonomous organization (DAO). dotUSD was designed without a central issuer, unlike stablecoins issued by private companies. DOT holders govern dotUSD decisions through OpenGov. Parity originally rated the vulnerability as medium severity because the assessment excluded possible interactions with dotUSD, which had not launched. Parity raised the rating to critical after the attack demonstrated the financial impact.
The security researcher who first reported the vulnerability published a forum comment referring to the code fix on October 20. Parity said the researcher deleted the comment after receiving notice that the disclosure breached Parity's bug bounty rules. Parity believes the comment may have supplied enough information for attackers to discover and exploit the flaw.
Snowfork stopped operating the company's consensus relayers after suspicious activity was detected on October 24. The shutdown temporarily prevented additional malicious transactions from entering Polkadot through Snowbridge. However, the attacker used an independently operated relayer on October 26 to restart the exploit, approximately six hours before developers implemented the security upgrade through OpenGov. Snowbridge permits independent participants to run relayers, so Snowfork could suspend Snowfork's infrastructure but could not permanently deny the attacker access.
Parity eliminated the vulnerability with runtime upgrade 2.5.1 on October 26 and recovered the affected pool's remaining liquidity. Another upgrade on October 30 repaired dotUSD's supply records without altering individual account balances. The October 30 upgrade also fixed a separate problem that had interrupted Snowbridge. The recovered dotUSD went back to the Treasury. However, the losses caused by trading at artificial prices remained.
Parity acknowledged that the company's security procedures had not captured changing risks from new network functionality. Parity said the company would improve vulnerability assessments, strengthen deployment verification and broaden monitoring for abnormal asset issuance. Parity is refining an automated AI-based security framework intended to detect potentially exploitable code changes earlier during development. Parity is also reviewing previously reported vulnerabilities for risks arising from dotUSD.
Polkadot Loses $1.38M After Hacker Exploits Fixed Security Flaw
CryptoSlateShare
Summary
Polkadot's Treasury lost $1.38 million after a hacker exploited a known vulnerability that had been fixed four months ago. The attack targeted the Polkadot Asset Hub's cross-chain messaging system, causing a dotUSD supply imbalance and enabling arbitrage. Parity Technologies confirmed the flaw was initially rated medium but upgraded to critical after the breach. The fix from June had not been deployed to live systems. Runtime upgrades have since been implemented to recover liquidity and align with CFT and MiCA compliance requirements.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.