Polkadot Asset Hub Bug Exploited, Leading to $1.38M Loss
An attacker exploited a bug in the XCM executor on Polkadot Asset Hub, resulting in a significant loss for the Polkadot Treasury. The incident involved a distortion in the pricing of dotUSD, but no user funds were affected.
Between October 24 and 26, 2026, an attacker took advantage of a bug in the XCM executor on Polkadot Asset Hub. This exploitation allowed the attacker to reduce the recorded issuance of dotUSD without altering the underlying account balances. As a result, the assumption that recorded issuance equals the sum of all balances was broken, leading to distorted pricing in the DOT/dotUSD pool and enabling arbitrage trades at an artificial rate.
The Polkadot Treasury, which acted as the sole liquidity provider, incurred an estimated loss of $1.381 million in DOT value due to this manipulation. It is important to note that no user funds were lost during this incident. The vulnerability had been reported through a bug bounty program and was fixed in the codebase in June 2026; however, the fix was not deployed to the affected production runtime in time to prevent the exploitation.
The incident highlights the impact of software vulnerabilities in blockchain systems and the importance of timely updates to production environments. The specific chain involved in this incident is Polkadot, though the exact chain details were not stated. The on-chain record does not provide specific addresses related to this incident.