Polkadot XCM Exploit Results in Approximately $1.381 Million Loss

From October 24 to 26, the XCM executor vulnerability on the Polkadot Asset Hub was exploited by attackers, leading to price distortion in the DOT/dotUSD pool and creating arbitrage opportunities, resulting in an estimated loss of approximately $1.381 million in DOT value. The Polkadot Treasury was the sole liquidity provider for this pool, and no user funds were lost. The vulnerability was reported in June through a bug bounty program, and the related code has been fixed, but the fix was not deployed in time to the affected mainnet version. On October 20, the reporter publicly mentioned the related fix in a forum, which may have provided clues to the attackers.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.