Polkadot's Asset Hub suffered a $1.38 million loss from its treasury due to an XCM executor vulnerability exploited between October 24 and 26. The attacker manipulated dotUSD ledger issuance without altering account balances, distorting pricing in the DOT/dotUSD pool and creating arbitrage opportunities. Polkadot Treasury was the sole liquidity provider for the affected pool, and no user funds were lost.
The vulnerability had been reported through Polkadot's bug bounty program in June, with a fix completed in the codebase but not deployed to the mainnet runtime version before the exploit occurred. On October 20, the reporter publicly mentioned the related fix on the forum, potentially providing attackers with clues about the unpatched vulnerability.
Polkadot remediated the issue through Runtime updates 2.5.1 and 2.5.2, correcting the dotUSD supply. Recovered funds have been returned to the Treasury.
Polkadot Loses $1.38M Treasury Funds to XCM Exploit After Patch Left Undeployed
免責事項: Phemexニュースで提供されるコンテンツは、あくまで情報提供を目的としたものであり、第三者の記事から取得した情報の正確性・完全性・信頼性について保証するものではありません。本コンテンツは金融または投資の助言を目的としたものではなく、投資に関する最終判断はご自身での調査と、信頼できる専門家への相談を踏まえて行ってください。