A Single Missing Bounds Check Let Attackers Mint a Billion DOT on Hyperbridge

Hyperbridge initially reported losses of $237,000 tied to an exploit that saw 1 billion DOT tokens minted out of nothing. Days later the protocol revised that number to $2.5 million, disclosing that two distinct attacks had taken place and that some users had unknowingly swapped into artificially cheap DOT once the pools were drained. The root cause traced back to a single line of validation code that was never written.

Hyperbridge had positioned itself as a bridge secured entirely by cryptographic proofs rather than human trust — no multisig, no validator set, no committee to compromise. That pitch had drawn a $5.3 million seed round backed by the Polkadot ecosystem, and it coincided with Polkadot governance, six weeks earlier, voting to hard-cap DOT supply at 2.1 billion tokens to bolster the asset's monetary credibility.

On April 1, Hyperbridge published a post claiming the Lazarus Group had stolen $37 million from its deployments — an April Fools prank, tied to a now-deleted blog explainer titled "Why Hyperbridge Can't Be Hacked." Founder Seun Lanlege had made a similar claim on the record months earlier: in a December 2025 interview, he stated that "unless the cryptographic libraries themselves fail, the proofs cannot be forged." Twelve days after the joke post, that library failed and the proofs were forged. Both the prank tweet and its blog post were subsequently deleted, replaced with a genuine incident report.

The underlying flaw came down to one absent bounds check — a require statement nobody wrote. Its absence let an attacker submit a fabricated proof, take admin control of the bridged DOT token contract on Ethereum, mint a billion tokens with no backing, and drain whatever the liquidity pool contained. The attacker did not break the cryptography itself; they exploited the gap between where the math ended and the Solidity implementation began.

01How the Incident Surfaced

Independent researcher Zilayo posted the first alert early on April 13: the admin role on the relevant contract had been reassigned to the attacker, and a billion DOT had been minted. PeckShield amplified the report 21 minutes later. CertiK followed shortly after with the transaction hash and a plain description of the mechanism: the attacker had pushed through a forged message, reassigned admin control of the Ethereum-side Polkadot token contract, minted a billion tokens, and cashed out roughly $237,000.

BlockSec's Phalcon unit added more technical context shortly after, initially describing the incident as an MMR proof-replay issue stemming from a missing binding between proof and request — an accurate read of the symptom, even if the precise root cause was refined in a later update. Phalcon's alert specifically named the HandlerV1 contract, listed six associated attack transactions, and confirmed the sequence: the DOT token's admin was changed first, then that access was used to mint.

Arkham was tracking the attacker's wallet as funds moved in real time. The primary attacker address identified on Arkham was 0xc513e4f5d7a93a1dd5b7c4d9f6cc2f52d2f1f8e7.

Hyperbridge itself stayed silent for hours. When the team eventually posted, the update was titled "Security Update!" with replies disabled — an unfortunate echo of the April Fools joke twelve days earlier. Polkadot's own account moved faster than the bridge team, confirming that native DOT and all parachains remained fully secure and unaffected. Parity Technologies told DL News much the same: no vulnerability existed in Polkadot's protocol, consensus mechanism, or audited core code.

Hyperbridge's initial statement cited $237,000 in losses; that figure grew to $2.5 million three days later. Bridging operations were paused, and the team said it was working with security partners to trace and recover funds.

02The Mechanism: One Digit, One Missing Check

Hyperbridge's cross-chain messaging design worked as follows: a user submits a request on Polkadot, a relayer carries a cryptographic proof of that request to Ethereum, and the HandlerV1 contract validates that proof before executing anything. That validation step was the entire foundation of the security model — a passing proof meant the underlying message, including instructions capable of reassigning control of a token contract, would be executed without further checks. Those instructions were routed to TokenGateway, the contract responsible for minting and burning the bridge's wrapped assets.

The attacker's objective was to make a fabricated message pass validation as if it were genuine, then submit a ChangeAssetAdmin request targeting the bridged DOT token contract. The relevant code path runs through HandlerV1.handlePostRequests, the function that processes incoming cross-chain messages. Its job is to fetch a Merkle root, confirm that the submitted message is included in that tree, and only then dispatch the requested action. The attacker's challenge was making a message they had fabricated from scratch pass that inclusion check.

The proof they submitted took this form:

MerkleMountainRange.VerifyProof(
  root: 0x466dddba7e9a84a0f2632b59be71b8bd489e3334a1314a61253f8b827c9d3a36,
  proof: [0x466dddba7e9a84a0f2632b59be71b8bd489e3334a1314a61253f8b827c9d3a36],
  leaves: [{ k_index: 0, leaf_index: 1, hash: 0xb870f0ca...318a99d }],
  leafCount: 1
)

Note that proof[0] is identical to root — a deliberate choice, not a coincidence. The underlying CalculateRoot() function contains a shortcut for single-leaf trees: when leafCount equals 1, leaves.length equals 1, and leaves[0].leaf_index equals 0, it returns the leaf hash directly without further computation.

The attacker set leaf_index to 1 rather than 0 — a one-digit change that skipped that shortcut entirely and routed execution into the function's general-case logic, which searches for leaves within each subtree. Because the leaf_index was out of bounds, no leaf matched any subtree. Rather than folding the (fake) leaf into the root calculation, the function fell through to the next entry in the proof array and pushed it directly onto the peak roots stack — which meant it effectively returned proof[0], the value the attacker had deliberately set equal to the real expected root. The computed root matched the expected root, and verification passed — despite the attacker's actual leaf hash never factoring into the calculation at all. It was inert decoration; the message was entirely invented, and the verifier accepted it without objection.

ChangeAssetAdmin then executed, transferring admin and minting rights over the bridged DOT token contract to 0xc513e4f5d7a93a1dd5b7c4d9f6cc2f52d2f1f8e7.

The infrastructure for cashing out was already in place before the forged proof was even submitted. A contract containing the mint-and-swap logic had been pre-deployed days earlier at 0x31a165a956842aB783098641dB25C7a9067ca9AB, and the exploit transaction deployed a minimal proxy at 0x518ab393c3f42613d010b54a9dcbe211e3d48f26 as the direct attack vehicle. From there, minting the billion tokens was trivial, and converting them into 108.2 ETH was constrained only by how much liquidity the pool actually held — about $237,000, representing the pool's full depth rather than any deliberate limit.

A single line — require(leaf_index < leafCount) — would have reverted the transaction before any of this occurred, but it was never written; the library carried no invariant enforcing it, and the calling code performed no independent validation of untrusted input before passing it into that security-critical function — each layer assumed the other was handling it. BlockSec Phalcon's final root-cause writeup summarized it directly: the verifier fails to enforce leaf_index < leafCount, so submitting leafCount = 1 with leaf_index = 1 means CalculateRoot() never actually incorporates the request commitment into the root — allowing the proof to validate arbitrary content entirely decoupled from the message it was supposed to authenticate.

03Two Attackers, One Vulnerability, Shifting Loss Totals

The incident turned out to involve more than a single attacker. According to on-chain investigator SpecterAnalyst, an earlier, lower-profile attack against Hyperbridge's TokenGateway contract extracted roughly 245 ETH — about $570,000 — before the higher-profile DOT-minting attack drew coverage. That earlier withdrawal was executed methodically: funds were split into 16.39 ETH per wallet across 15 separate addresses, then routed into Tornado Cash, with no negotiation and no attempt to contact the team for a bounty. That transaction (0xeff151ef58d57d6523874a7b97344fcd1ce3c7c6880cfc26a93da17f82062d59) appears to be a separate incident, unconnected to the HandlerV1 vulnerability described above.

Relevant addresses from that earlier attack:

• TokenGateway contract: 0xFd413e3AFe560182C4471F4d143A96d3e259B6dE
• Attacker address: 0xc0564bBa9Ba5A9bE95AE866429F936012E1bF143
• Contract used in attack: 0xCcd363E1A098558b17431b934fffac9906855a5d
• Attack transaction: 0xeff151ef58d57d6523874a7b97344fcd1ce3c7c6880cfc26a93da17f82062d59

The larger, headline exploit followed at 03:55 UTC on April 13. The same TokenGateway contract managed four different assets, all affected within the same transaction: alongside the 1 billion DOT, the attacker also minted roughly 999 billion ARGN tokens and targeted the MANTA and CERE tokens as well. The ARGN mint is recorded in transaction 0xb28ab9526e1538bdb7a26ec8485d055f9e417620c72a2f4de0f42234b5f8ac09.

Additional on-chain references from the main exploit:

• HandlerV1 contract (vulnerable): 0x6C84eDd2A018b1fe2Fc93a56066B5C60dA4E6D64
• Hijacked DOT token contract: 0x8d010bf9c26881788b4e6bf5fd1bdc358c8f90b8
• Primary attacker: 0xc513e4f5d7a93a1dd5b7c4d9f6cc2f52d2f1f8e7
• Primary attack transaction (1 billion DOT minted): 0x240aeb9a8b2aabf64ed8e1e480d3e7be140cf530dc1e5606cb16671029401109
• Additional attack transactions: 0xb93aab835e4002f7d46b63e37a156c78abd1d9256df094d63321deeb514a0634, 0x6f1efcde4a52db999c8cd233364d889292ae5ba357d9f2ead3dd3774010a0808, 0x743f4bdb67df7e6db57346e557f94ded8d7f85e854040963b7f345545e227125, 0xb80c7d4cde034689eb9aa42f0d28aa01d12e233e3805a7c8888ed871b7443c3a, 0xb28ab9526e1538bdb7a26ec8485d055f9e417620c72a2f4de0f42234b5f8ac09, 0xfa23fb22cc8ff10518e561817dea838d3232f7573fd90bd81fd7a30a9161b6f6

The combined notional value of everything minted across these transactions ran into the billions of dollars on paper, but the shallow liquidity available on Ethereum meant the attacker could only convert a small fraction of that into real value. In total, the two separate attacks account for roughly $806,000 in confirmed, realized losses on-chain: the main attacker's approximately $237,000 (capped by pool depth) plus the earlier attacker's roughly 245 ETH, or about $570,000.

Three days after the initial disclosure, Hyperbridge raised its official loss estimate to approximately $2.5 million. That larger figure incorporates not just the funds the attackers directly extracted, but losses across incentive pools on Ethereum, Base, BNB Chain, and Arbitrum. Those pools were tied to the DeFi Singularity campaign, a 795,000 DOT Polkadot treasury program that had been actively recruiting outside liquidity providers into the very positions that were wiped out.

Hyperbridge has also identified a third category of affected parties: ordinary users who, during or shortly after the attack, spotted the distorted DOT pricing in the drained pools, swapped other tokens for an outsized amount of DOT, and bridged it back to Polkadot. The protocol opened a 14-day voluntary return window for those wallets, warning that non-compliant addresses would be referred to law enforcement along with documented on-chain evidence.

04A Joke Twelve Days Before the Real Thing

The timing invites scrutiny on its own. Twelve days before the actual exploit, Hyperbridge had posted that the Lazarus Group drained $37 million from its Ethereum, Arbitrum, and Base deployments. It was an April Fools gag, linking to a now-deleted blog post that opened with a Rickroll GIF before pivoting into an explainer titled "Why Hyperbridge Can't Be Hacked." Both the blog post and the accompanying tweet were later removed, and the team's actual breach notice opened, without apparent irony, with the same "Security Update!" framing and disabled replies.

Hyperbridge's official statement drew a specific distinction: the proof-based architecture itself — cryptographic proofs derived directly from blockchain state, removing the need for validators or multisig committees — was not what failed. What failed was a specific vulnerability in the Solidity-based MMR proof verification logic, located in the Merkle tree verifier implementation. It's a real distinction, though Lanlege's December 2025 statement that "unless the cryptographic libraries themselves fail, the proofs cannot be forged" didn't survive April 13 intact.

The broader context around Polkadot compounds the irony. Roughly a month before the exploit, Polkadot governance passed a hard supply cap of 2.1 billion DOT with 81% approval, cutting emissions by 53.6% and deliberately setting the effective date on Pi Day as a nod to the decay formula involved. Separately, the 21Shares TDOT ETF launched on Nasdaq on March 6, giving traditional investors direct exposure to DOT. A governance-enacted scarcity measure paired with a new retail-accessible investment vehicle had built weeks of institutional momentum — momentum that the forged-proof exploit then interrupted by minting a billion DOT on the Ethereum side, even though native Polkadot's supply cap and the relay chain itself were never touched.

Notably, Hyperbridge's security assurances rested on a single audit — one that had already flagged concerns about the Solidity libraries, concerns that went unaddressed.

05The Audit That Flagged It First

SR Labs audited Hyperbridge in June 2024. The 26-page report has been publicly posted on GitHub for nearly two years. On page 4, Table 1, HandlerV1.sol is explicitly listed among the in-scope components, marked with a priority of High. The auditors identified one high-severity, one medium-severity, and three low-severity issues across the Solidity modules; the high- and medium-severity findings were fixed. Of the low-severity findings, two were accepted and one remained open — a configuration issue that could become permanently locked due to the finality of updates.

Further into the report, on page 23, in a section on suggested future work, SR Labs included a recommendation the team appears not to have acted on: "The investigation conducted on EvmHost.sol and HandlerV1.sol was heavily constrained in scope. Based on our investigation we believe that the Solidity implementation requires further analysis from a team specialized in smart contract auditing. We recommend investing further resources into the security of the Solidity codebase, including the associated custom libraries." Those "associated custom libraries" include the solidity-merkle-trees library written by Polytope Labs — the same library containing the CalculateRoot function at the center of the exploit.

The report's threat model, on page 8, sharpens the point further: SR Labs explicitly named "Replay ISMP messages" and "Exploit a bug in validation scheme to accept an invalid transaction" as high-value integrity threats, rated medium effort but high incentive and high hacking value. The April 13 attack matches both descriptions closely. This is the same audit that Seun Lanlege cited when he told TechCabal in November 2025 that security was Hyperbridge's "core obsession" — the audit in which the auditors had already said the Solidity codebase and its custom libraries needed further specialist review, and had already flagged replay attacks against the proof validation scheme as high-value threats.

It wasn't the only prior warning sign. In January 2025, a GitHub security advisory for the ismp-grandpa crate disclosed a critical vulnerability: a missing negation check that caused the verifier to accept only invalid signatures — a verifier accepting bad input, discovered and patched internally before it could be exploited. The parallel to the April 13 incident is direct; the difference is that one was caught in time and the other wasn't.

The pattern also extended beyond Hyperbridge itself. On April 14, the day after the exploit, Polkadot SDK developer sorpaas disclosed a critical vulnerability in the Polkadot relay chain: a proof-verification bug in pallet_mmr of the same general class, introduced in May 2024, that could have let an attacker submit forged BEEFY offense reports — potentially disabling up to 199 of 600 validators and triggering slashes totaling roughly 446 million DOT, subject to a 28-day governance window. The fix, PR #11738, was merged on April 13 — the same day as the Hyperbridge exploit. That bug had existed in the SDK codebase for 702 days and in live production for roughly 485 days. Notably, the SR Labs Hyperbridge audit went public in June 2024, one month after this same bug class was introduced into the Polkadot SDK — meaning the auditors were reviewing Hyperbridge's proof-verification implementation around the same time this parallel flaw entered the SDK. Sorpaas's disclosure explicitly recommends a full audit of the Polkadot SDK for any proof-verification issues resembling the Hyperbridge case.

06Where Things Stand

The loss figure moved from $237,000 to $2.5 million over the course of a few days. On-chain, the two identifiable attacks — the earlier 245 ETH (~$570,000) withdrawal SpecterAnalyst identified and confirmed in Hyperbridge's own April 16 update, plus the main attacker's roughly $237,000 — total around $806,000 in realized losses; the remainder of the $2.5 million figure reflects incentive-pool losses across the four affected chains. Hyperbridge says its forensics partners have identified the relevant wallets and compiled full transaction histories, and the 14-day voluntary return window remains open before matters are referred to law enforcement.

Both the April Fools blog post and its accompanying tweet remain deleted. What's left is a bridge that stays paused until the patch is verified. The main attacker didn't linger: Arkham confirmed that the address behind the DOT exploit moved its funds to Tornado Cash — $269,000 in total — leaving roughly $515 behind in the wallet.

None of this stemmed from a broken cryptographic model — the underlying math held up. What failed were the lines of Solidity sitting between that math and the money: untested at their edges, never reviewed by Solidity specialists despite an explicit audit recommendation to do so, and left unprotected by a single bounds check that would have taken almost no effort to add. A protocol built on the argument that human trust is the weak point in bridge security ended up undone by a library nobody outside the team had properly reviewed — despite being told, in writing, two years earlier, that it should be.