Polkadot Treasury Loses $1.38 Million in Exploit
An attacker used a previously fixed vulnerability to drain funds from the network's Treasury, according to reporting on the incident.
Updated on Nov. 4, 2026 in Cybersecurity
Attackers exploited a security flaw that Parity Technologies had identified and corrected in June, draining $1.38 million from Polkadot's Treasury between Oct. 24 and 26. Parity is now overhauling its security processes in response.
Why it matters
The incident shows how a vulnerability fixed in one codebase can remain exploitable across connected systems if patches do not fully propagate. A developer believes a forum comment referencing the fix may have given attackers enough information to act.
The attacker manipulated Polkadot Asset Hub's cross-chain messaging to reduce dotUSD's recorded supply without removing tokens from user accounts, then ran an independent relayer on Oct. 26 to bypass Snowfork's halt of its consensus relayers. The Treasury was the sole liquidity provider for the DOT/dotUSD pool, and the flaw predated the dotUSD stablecoin's launch.
The players
Parity Technologies
Parity Technologies is a blockchain software company that develops core infrastructure for the Polkadot and Kusama networks.
Snowfork
Snowfork is a blockchain interoperability project that operates cross-chain bridge relayers for the Polkadot ecosystem.
The details
A security researcher posted a forum comment referencing the code fix on Oct. 20 and later removed it after being told it violated bug bounty rules. Parity closed the vulnerability through runtime upgrade 2.5.1 on Oct. 26, but the attacker resumed the exploit within about six hours of that upgrade.
Timeline
June: Parity identified and corrected the vulnerability in its codebase.
October 2025: The dotUSD stablecoin launched under DAO governance.
Oct. 20: A researcher posted a forum comment referencing the code fix.
Oct. 24-26: The attack exploiting the vulnerability occurred.
Oct. 26: Parity closed the vulnerability via runtime upgrade 2.5.1.
Tech Race
The exploit targeted Polkadot Asset Hub's cross-chain messaging system, which connects Polkadot with other blockchain networks and has become central to multi-chain token issuance. The incident raises questions about whether interoperability layers can be secured as quickly as competing networks expand them.
Users of dotUSD and Polkadot-based assets face uncertainty about how the exploit affected token supply records and liquidity pools. Anyone holding assets tied to the affected pool should monitor official Polkadot and Parity communications for updates on remediation.
The takeaway
Security fixes applied in one part of a connected blockchain system must be verified across every dependent component before attackers can exploit the gap. Developers and users alike benefit from treating disclosure timing and bug bounty rules as active security concerns.
Further reading
Explore more reporting in the Cybersecurity section for context on how blockchain networks defend against exploits like this one.
