Polkadot's Treasury lost $1.38 million after an attacker exploited a vulnerability developers had fixed months before its new stablecoin launched.
Related Asset Polkadot #46 DOT · $0.97 24-hour change: up 2.80% Loading price history… 24H Up 2.80% 7D Down 3.27% 30D Down 18.99%
In a Nov. 2 incident report, Parity Technologies, a blockchain infrastructure firm focused on the Polkadot and Kusama ecosystems, revealed that the security flaw had been identified and corrected in its codebase in June but never reached the affected production systems before the Oct. 24-26 attack.
The disclosure exposes a security breakdown surrounding dotUSD, Polkadot's decentralized stablecoin, which launched in October under the governance of the network's decentralized autonomous organization (DAO).
Unlike stablecoins issued by private companies, dotUSD was designed to operate without a centralized issuer, with DOT holders governing decisions through the network's OpenGov system.
Related Company Parity Technologies Blockchain Infrastructure for the Decentralised Web
However, the vulnerability predated the stablecoin's introduction. Parity initially classified the bug as medium severity because its assessment did not account for how the flaw could interact with dotUSD, which had not yet launched.
The developer later upgraded the vulnerability to critical after the attack exposed its financial consequences.
The breach also followed a public disclosure on Oct. 20, when the security researcher who originally reported the vulnerability posted a forum comment referencing the code fix.
Parity said the researcher removed the comment after being notified that it violated the company's bug bounty rules. The developer believes the disclosure may have given attackers enough information to identify and exploit the vulnerability.
The attacker ultimately manipulated Polkadot Asset Hub's cross-chain messaging system to reduce dotUSD's recorded supply without removing tokens from users' accounts.
That discrepancy distorted prices in the network's DOT/dotUSD liquidity pool, allowing traders to exchange dotUSD for DOT at artificial rates.
The Treasury, which was the pool's sole liquidity provider, absorbed approximately $1.381 million in losses.
Parity stressed that no users lost funds and dotUSD remained fully backed by USDT. However, the company could not establish whether the person who exploited the vulnerability also profited from the subsequent arbitrage trades.
Related Asset Tether USDT · Stablecoin
The Polkadot bug fix that missed production before a $1.38M loss
Parity merged a fix for the XCM bug in June, but it did not reach the affected runtimes before the October dotUSD exploit. The containment halt could be bypassed.
Polkadot XCM fix timeline from June bug report to October remediationPOLKADOT · XCM / dotUSD · 2026A fix was ready in June. The exploit arrived in October.The issue was corrected in code, but never reached the affected production runtime before the attack.FIX AVAILABLE · JUNE 2026Missed the affected production release$1.381MTreasury lossNo users lost fundsREPORTED SEQUENCE · POSITIONS ARE NOT TO SCALE
- JUNEFix mergedin codebase20 OCTPublic commentreferenced fix24 OCTExploit found;relayers halted26 OCTAttacker rerouted;XCM fix applied30 OCTSupply correctedby runtime 2.5.2Why the halt failedSnowfork paused its own relayers. The attacker used an independent, permissionless relay route on Oct. 26.The on-chain XCM fix ended the flaw; the Oct. 30 upgrade subsequently repaired supply accounting.Parity did not establish whether the XCM attacker also profited from later arbitrage.
Vertical Polkadot XCM timeline showing missed June fix and October attackPOLKADOT · XCM / dotUSD · 2026The fix was ready in June.The attack came in October.A codebase fix missed production, leavingdotUSD exposed when the exploit arrived.$1.381MTreasury pool loss · no user funds lostSEQUENCE · NOT TO SCALE
- JUNEBug reported; fix mergedbut not deployed20 OCTForum comment pointedto the existing fix24 OCTExploit found; Snowforkpaused its relayers26 OCTAttacker resumed via ownrelayer before 2.5.1 fix30 OCTRuntime 2.5.2 correctedrecorded dotUSD supplyWhy the halt failedSnowbridge accepts independent relayers.Only the on-chain fix closed the flaw.Parity could not attribute the later arbitrage profit.
How an emergency relayer halt was bypassedHow an emergency relayer halt was bypassed24 Oct: halt26 Oct: bypass
Snowfork stopped its own relayers. The XCM flaw remained, and other operators could still run relayers.
Snowfork's relayer halt delays attackEthereummessagesSnowforks own relayersHALTEDPermissionless relay routeOther operators could relayAsset Hub XCMStill vulnerable
Only Snowfork's relayers haltedEthereum messages
- Snowforksown relayersHALTEDOther operatorscould relayPERMISSIONLESS
Asset Hub XCMStill vulnerableAttack stopped temporarilyStopping one operator left the flaw intact.
The attacker ran its own consensus relayer and resumed about six hours before the XCM fix took effect.
Attacker bypasses Snowfork's haltEthereummessagesSnowfork‘s own relayersHALTEDAttacker’s own relayerOperating on October 26Asset Hub XCMStill vulnerable
Attacker bypasses operator haltEthereum messages
- Snowfork‘sown relayersHALTEDAttacker’s ownrelayerOPERATING
Asset Hub XCMStill vulnerableAttack resumed before 2.5.1Replacement route bypassed the halt.
Snowfork stopped its own relayers, but the attacker ran another. Runtime 2.5.1 fixed XCM on Oct. 26; 2.5.2 reconciled dotUSD supply on Oct. 30.
Parity said the Oct. 20 public comment may have helped attackers; that link remains unproven. The identity of the arbitrage beneficiary is unresolved. The Treasury was the pools sole liquidity provider, and users lost no funds. The timeline is not a record of bridge availability.
Sources and evidence
Sources
- Paritys November 2 incident review
- Executed runtime 2.5.1
- Executed supply and bridge repair
- Permissionless relay architecture
- Parity said the XCM flaw was reported and fixed in its codebase in June 2026, but the fix missed the stable-2606 cutoff and was absent from affected production runtimes. [1]
- Parity said a researcher published an October 20 forum comment referencing the June code fix and later removed it; Parity believes it may have helped attackers identify the vulnerability. [1]
- The XCM exploit reduced recorded dotUSD issuance without altering account balances, distorting pricing in the DOT/dotUSD pool; Parity estimated a $1.381 million Treasury loss and said no users lost funds. [1]
- Snowfork halted its own consensus relayers on October 24, temporarily stopping the attack; the attacker ran its own consensus relayer and resumed on October 26, about six hours before the runtime upgrade took effect. [1]
- Snowbridge documentation describes relayers as permissionless off-chain processes that anyone can run; Snowforks own relayer halt therefore could only delay the attack, which resumed when the attacker supplied its own relayer. [4] [1]
- Runtime 2.5.1, proposed on October 24 and applied on-chain on October 26 according to Paritys review, contained the XCM fix; referendum 1960 is marked Executed. [1] [2]
- Runtime 2.5.2 was enacted October 30, correcting dotUSDs recorded supply from existing account balances without changing individual balances, according to Parity; executed referendum 1961 describes the same correction. [1] [3]
Supporting facts
Method
Timeline follows Parity‘s Nov. 2 incident review and executed referenda 1960 and 1961; the permissionless relay explanation uses Snowbridge documentation. Dates mark the reported sequence; spacing does not encode duration. Loss is Parity’s estimate.
Scope
Parity said the Oct. 20 public comment may have helped attackers; that link remains unproven. The identity of the arbitrage beneficiary is unresolved. The Treasury was the pools sole liquidity provider, and users lost no funds. The timeline is not a record of bridge availability.
Infographic by CryptoSlate
Hacker bypassed emergency shutdown before Polkadot deployed security fix
The incident became more complicated when the attacker circumvented an emergency containment measure intended to stop the exploit.
After suspicious activity was detected on Oct. 24, Snowfork halted its consensus relayers, temporarily preventing further malicious transactions from reaching Polkadot through the Snowbridge network.
However, the attacker operated an independent relayer on Oct. 26, resuming the exploit approximately six hours before developers deployed the security upgrade through OpenGov.
The workaround was possible because Snowbridge allows independent participants to operate relayers, meaning Snowfork's intervention could interrupt its own infrastructure without permanently blocking the attacker's access.
Parity eventually closed the vulnerability through runtime upgrade 2.5.1 on Oct. 26 and rescued the remaining liquidity from the affected trading pool.
A second upgrade followed on Oct. 30, correcting dotUSD's recorded supply without changing individual account balances and resolving a separate issue that had disrupted Snowbridge.
The recovered dotUSD was returned to the Treasury, although the financial losses from the artificial trading activity remained.
Parity acknowledged that its existing security processes failed to account for the evolving risk introduced by new network functionality.
The company said it would strengthen vulnerability assessments, improve deployment checks and expand monitoring for unusual asset issuance.
It is also refining an automated AI-based security framework to identify potentially exploitable code changes earlier in development, while reassessing previously reported vulnerabilities for risks introduced by dotUSD.