Skip to content
- The Hyperbridge exploit caused a $237K loss on Ethereum, bridging was paused, and an investigation is ongoing.
- The verification flaw let forged proofs pass, and the attacker gained control of the bridged token contract.
- Above 1B DOT minted and sold, impact limited to bridged assets, core design not compromised.
Hyperbridge, a decentralized protocol, reported a vulnerability that caused about $237,000 in losses on Ethereum after its Token Gateway was exploited by an attacker. The protocol paused bridging operations immediately and launched an investigation to assess the breach and contain further impact.
The team shared details in a post on X on Monday. It confirmed that bridging activity was stopped as soon as the issue was detected. Investigations remain ongoing.
Proof Verification Bug Enabled Unauthorized Access
The exploit had been associated with a bug in proof verification logic. The technical problem related to the verification of Merkle Mountain Range proofs within a Solidity contract. It is in this process that cross-chain messages are verified.
Security company BlockSec analyzed the event and discovered omitted validation checks. The verification function did not properly validate some inputs. This made it possible for forged proofs to appear valid.
Using these fake proofs, the attacker sends a malicious message. The system went ahead and processed the message as if there were nothing wrong. However, this allowed the bridged token contract to be accessed without authorization.
Also Read: Ethereum Treasury Firm Ether Machine Halts SPAC Deal with Dynamix
Furthermore, once the attacker gained control, they minted a significant number of synthetic assets. About 1 billion bridged DOT tokens were minted. This was above the normal circulating supply.
Hyperbridge Exploit Drives Token Sell-Off and Losses
The attacker proceeded to sell the tokens on decentralized exchanges. This was an opportunity for value extraction before the exploit could be contained. That activity added to the reported losses.
Moreover, Hyperbridge said that only DOT tokens bridged on Ethereum were affected. Native Polkadot assets were unaffected. The rest of the ecosystem was unaffected.
The exploit did not compromise the core cryptographic design, the team said. The bridge is based on blockchain state proofs instead of validator or multisig systems. It was an implementation issue.
While Hyperbridge is collaborating with security partners to track the funds. Bridging services will stay suspended until updates are deployed and audited. The authorities have not given a timeline for operations to resume.
Also Read: Polymarket News Listings Pulled by Google After Brief Exposure
