Polkadot lost $1.38 million after hacker exploited security flaw fixed four months earlier. The attacker exploited a vulnerability fixed in June but missing from production, targeting Polkadot's newly launched dotUSD stablecoin and exposing weaknesses in its security response. Senior Reporter - CryptoSlate Nov. 4, 2026 at 2:50 pm GMT Quick take. * 01 Polkadot lost $1.38 million after a hacker exploited a security flaw fixed in June but never deployed to affected production systems. * 02 The attacker bypassed an emergency shutdown to resume exploiting dotUSD, Polkadot's newly launched stablecoin, before a critical upgrade took effect. * 03 Parity is overhauling its security processes after the incident exposed weaknesses in vulnerability assessments, patch deployment and emergency response. Polkadot's Treasury lost $1.38 million after an attacker exploited a vulnerability developers had fixed months before its new stablecoin launched. In a Nov. 2 incident report, Parity Technologies, a blockchain infrastructure firm focused on the Polkadot and Kusama ecosystems, revealed that the security flaw had been identified and corrected in its codebase in June but never reached the affected production systems before the Oct. 24-26 attack. The disclosure exposes a security breakdown surrounding dotUSD, Polkadot's decentralized stablecoin, which launched in October under the governance of the network's decentralized autonomous organization (DAO). Unlike stablecoins issued by private companies, dotUSD was designed to operate without a centralized issuer, with DOT holders governing decisions through the network's OpenGov system. However, the vulnerability predated the stablecoin's introduction. Parity initially classified the bug as medium severity because its assessment did not account for how the flaw could interact with dotUSD, which had not yet launched. The developer later upgraded the vulnerability to critical after the attack exposed its financial consequences. The breach also followed a public disclosure on Oct. 20, when the security researcher who originally reported the vulnerability posted a forum comment referencing the code fix. Parity said the researcher removed the comment after being notified that it violated the company's bug bounty rules. The developer believes the disclosure may have given attackers enough information to identify and exploit the vulnerability. The attacker ultimately manipulated Polkadot Asset Hub's cross-chain messaging system to reduce dotUSD's recorded supply without removing tokens from users' accounts. That discrepancy distorted prices in the network's DOT/dotUSD liquidity pool, allowing traders to exchange dotUSD for DOT at artificial rates. The Treasury, which was the pool's sole liquidity provider, absorbed approximately $1.381 million in losses. Parity stressed that no users lost funds and dotUSD remained fully backed by USDT. However, the company could not establish whether the person who exploited the vulnerability also profited from the subsequent arbitrage trades. Hacker bypassed emergency shutdown before Polkadot deployed security fix. The incident became more complicated when the attacker circumvented an emergency containment measure intended to stop the exploit. After suspicious activity was detected on Oct. 24, Snowfork halted its consensus relayers, temporarily preventing further malicious transactions from reaching Polkadot through the Snowbridge network. However, the attacker operated an independent relayer on Oct. 26, resuming the exploit approximately six hours before developers deployed the security upgrade through OpenGov. The workaround was possible because Snowbridge allows independent participants to operate relayers, meaning Snowfork's intervention could interrupt its own infrastructure without permanently blocking the attacker's access. Parity eventually closed the vulnerability through runtime upgrade 2.5.1 on Oct. 26 and rescued the remaining liquidity from the affected trading pool. A second upgrade followed on Oct. 30, correcting dotUSD's recorded supply without changing individual account balances and resolving a separate issue that had disrupted Snowbridge. The recovered dotUSD was returned to the Treasury, although the financial losses from the artificial trading activity remained. Parity acknowledged that its existing security processes failed to account for the evolving risk introduced by new network functionality. The company said it would strengthen vulnerability assessments, improve deployment checks and expand monitoring for unusual asset issuance. It is also refining an automated AI-based security framework to identify potentially exploitable code changes earlier in development, while reassessing previously reported vulnerabilities for risks introduced by dotUSD. Article context Editorial credits. Senior Reporter - CryptoSlate Oluwapelumi values Bitcoin's potential. He imparts insights on a range of topics like DeFi, hacks, mining and culture, underlining transformative power.

Velocity Labs, in partnership with key players in the Polkadot ecosystem, launches the DeFi Builders Program to foster innovation in decentralized finance.