Polkadot's Asset Hub suffered a $1.38 million loss from its treasury due to an XCM executor vulnerability exploited between October 24 and 26. The attacker manipulated dotUSD ledger issuance without altering account balances, distorting pricing in the DOT/dotUSD pool and creating arbitrage opportunities. Polkadot Treasury was the sole liquidity provider for the affected pool, and no user funds were lost. The vulnerability had been reported through Polkadot's bug bounty program in June, with a fix completed in the codebase but not deployed to the mainnet runtime version before the exploit occurred. On October 20, the reporter publicly mentioned the related fix on the forum, potentially providing attackers with clues about the unpatched vulnerability. Polkadot remediated the issue through Runtime updates 2.5.1 and 2.5.2, correcting the dotUSD supply. Recovered funds have been returned to the Treasury.