Polkadot's Asset Hub suffered a $1.38 million loss from its treasury due to an XCM executor vulnerability exploited between October 24 and 26. The attacker manipulated dotUSD ledger issuance without altering account balances, distorting pricing in the DOT/dotUSD pool and creating arbitrage opportunities. Polkadot Treasury was the sole liquidity provider for the affected pool, and no user funds were lost.
The vulnerability had been reported through Polkadot's bug bounty program in June, with a fix completed in the codebase but not deployed to the mainnet runtime version before the exploit occurred. On October 20, the reporter publicly mentioned the related fix on the forum, potentially providing attackers with clues about the unpatched vulnerability.
Polkadot remediated the issue through Runtime updates 2.5.1 and 2.5.2, correcting the dotUSD supply. Recovered funds have been returned to the Treasury.
Polkadot Loses $1.38M Treasury Funds to XCM Exploit After Patch Left Undeployed
Aviso legal: El contenido de Phemex News es únicamente informativo.No garantizamos la calidad, precisión ni integridad de la información procedente de artículos de terceros.El contenido de esta página no constituye asesoramiento financiero ni de inversión.Le recomendamos encarecidamente que realice su propia investigación y consulte con un asesor financiero cualificado antes de tomar cualquier decisión de inversión.