Polkadot XCM Exploit Costs Treasury $1.38M
Polkadot’s Asset Hub was exploited from 24 to 26 October through a vulnerability in its XCM executor, causing an estimated $1.381 million in DOT value losses for the Polkadot Treasury. The attacker reduced dotUSD’s recorded supply without changing account balances, distorting prices in the DOT/dotUSD pool and creating arbitrage opportunities. The Treasury was the pool’s only liquidity provider, so other users did not lose funds. The vulnerability had been reported through a bug bounty programme and fixed in code in June, but the patch was not deployed to the affected mainnet runtime. A forum post about the fix on 20 October may have alerted the attacker. Polkadot later addressed the issue with Runtime versions 2.5.1 and 2.5.2, corrected dotUSD’s supply and returned recovered funds to the Treasury.
Neutral
The exploit creates a short-term security concern for Polkadot and could prompt some traders to reduce DOT exposure while they assess the network’s safeguards and patch deployment process. However, the reported loss was borne by the Treasury, which was the pool’s sole liquidity provider; other users were not affected, and recovered funds were returned. Polkadot also issued Runtime 2.5.1 and 2.5.2 and corrected dotUSD’s supply. These factors limit the direct impact on DOT demand and market stability. In the longer term, confidence will depend on whether runtime updates are deployed promptly and whether further vulnerabilities emerge. With no reported broader user losses or lasting disruption, the expected price impact on DOT is neutral, though headlines or renewed security concerns could cause brief volatility.