Hyperbridge Revises Polkadot Bridge Exploit Losses to $2.5 Million, 10x Initial Estimate

Hyperbridge has revised its loss estimate from a Token Gateway exploit to $2.5 million, approximately 10 times the initially reported $237,000, after an attacker exploited a vulnerability in the Merkle Mountain Range proof verification logic to mint 1 billion wrapped Polkadot tokens and extract 245 ETH. The breach affected four blockchains—Ethereum, Base, Arbitrum, and BNB Chain—not just Ethereum as originally stated, and bridging functionality remains paused pending a security patch and audit. Stolen funds have been traced to Binance, where Hyperbridge is working with compliance teams and law enforcement for recovery, though the timeline may extend up to a year. The company has committed to using BRIDGE token allocation to cover any unrecovered losses, though the token's $858,000 market cap represents only one-third of total damages.

Revised Exploit Losses and Attack Methodology

• ▪Hyperbridge's exploit resulted in estimated losses of approximately $2.5 million.
• ▪A smart contract on Hyperbridge was exploited for 245 ETH worth approximately $561,000 hours before the malicious DOT token mintings.
• ▪The Hyperbridge attacker minted 1 billion wrapped Polkadot (DOT) tokens through the exploit.
• ▪Hyperbridge originally reported $237,000 in funds exploited from the bridge attack.
• ▪The Hyperbridge attacker extracted approximately 245 ETH from a TokenGateway contract.
• ▪An attacker exploited a vulnerability in the Merkle Mountain Range (MMR) proof verification logic on Hyperbridge.
• ▪The Hyperbridge exploit losses were approximately 10 times worse than the initial estimate.

Multi-Chain Impact and Asset Tracing

• ▪The stolen funds from the Hyperbridge exploit have been traced to a deposit address on Binance.
• ▪The Hyperbridge exploit impacted four blockchains: Ethereum, Base, Arbitrum, and BNB Chain.
• ▪Hyperbridge bridging functionality will only resume after a patch is deployed and audited.
• ▪Hyperbridge originally reported that only wrapped DOT on Ethereum was affected by the exploit.
• ▪Bridging functionality on Ethereum, Base, Arbitrum, and BNB Chain remains paused following the Hyperbridge exploit.

Recovery Efforts and User Compensation Plans

• ▪BRIDGE token traded at approximately $0.006 on March 29 with 24-hour trading volume of $1,800.
• ▪BRIDGE token had a market cap of approximately $858,000 on March 29, about one-third of the total Hyperbridge exploit losses.
• ▪Hyperbridge is committed to a structured BRIDGE token allocation to cover residual losses if unable to recover stolen funds.
• ▪Hyperbridge expects the realistic timeline for meaningful recovery to be measured in months and can extend up to a year.

Perspective of Hyperbridge

• ▪Hyperbridge is working with Binance's compliance team and law enforcement to freeze and recover the stolen assets from the Token Gateway exploit.
• ▪Hyperbridge will only resume bridging functionality after deploying and auditing a patch for the Merkle Mountain Range proof verification vulnerability.

Perspective of BRIDGE token holders

• ▪BRIDGE token's market cap of approximately $858,000 represents only one-third of the $2.5 million in Hyperbridge exploit losses.
• ▪BRIDGE token holders may face dilution from Hyperbridge's planned structured token allocation to cover unrecovered exploit losses.

2 sources