🚨 Hyperbridge (Polytope Labs) TokenGateway - Loss $237K (2026-04-13)

Token: $DOT @ $1.23
MC: $2.07B
TVL: N/A

Type: Forged Cross-Chain Merkle Proof

Attacker forged a cross-chain governance message appearing to originate from Hyperbridge on POLKADOT-3367. The HandlerV1 accepted the proof because the attacker set leafCount=1 with the proof equal to the stored overlayRoot, trivially passing Merkle verification. With challengePeriod set to 0, there was no dispute window. The forged ChangeAssetAdmin message transferred admin rights of the bridged DOT (ERC6160Ext20) token to the attacker's contract, which then minted 1B DOT and swapped it for ~108.2 ETH via OdosRouterV3 through a Uniswap V4 DOT/ETH pool.

TX: https://etherscan.io/tx/0x240aeb9a8b2aabf64ed8e1e480d3e7be140cf530dc1e5606cb16671029401109
Victim: https://etherscan.io/address/0xfd413e3afe560182c4471f4d143a96d3e259b6de (TokenGateway)
CoinGecko: https://www.coingecko.com/en/coins/polkadot