Polkadot Treasury Loses $1.38M to XCM Flaw Fixed Months Before Attack
Polkadot's Treasury lost approximately $1.38 million after an attacker exploited an XCM messaging flaw that developers had patched in June but never deployed to production. No user funds were lost, according to Parity Technologies, though the company said it could not determine whether the attacker profited from subsequent arbitrage.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
What Happened
Polkadot's Treasury lost about $1.381 million in an exploit conducted between October 24 and 26, according to a November 2 incident report from Parity Technologies. The figure is Parity's estimate, and the Treasury was the sole liquidity provider for the DOT/dotUSD pool that the attacker drained through artificial pricing.
The vulnerability sat in the cross-chain messaging layer, XCM, on Polkadot Asset Hub. The attacker manipulated that system to reduce dotUSD's recorded supply without removing tokens from holders' accounts, which distorted prices in the liquidity pool and let traders swap dotUSD for DOT at rates that did not reflect the underlying asset. Parity said dotUSD remained fully backed by USDT throughout.
Why the Patch Did Not Protect Production
Parity merged a fix for the XCM bug in June, but the change did not reach the affected runtimes before the October exploit. The company's own assessment initially rated the flaw medium severity because it did not account for how the bug could interact with dotUSD, which had not yet launched. Parity later raised the rating to critical after the attack exposed the financial consequences.
The gap between code fix and deployment is central to the incident. Parity has framed it as a failure of its security response, and the sequence shows that a patch merged into a codebase is not protection until it ships to live systems.
Disclosure and Containment
A public forum comment posted on October 20 referenced the code fix. Parity said the original security researcher removed the comment after being told it breached the company's bug bounty rules. Parity believes the comment may have given attackers enough information to find and exploit the flaw, but the company has not proven that link, and the report does not establish it as fact.
Snowfork, which operates the Snowbridge bridge, halted its consensus relayers after suspicious activity was detected on October 24. The containment measure was incomplete. Sources differ on the mechanics: Parity's account describes the attacker running its own consensus relayer and resuming about six hours before the XCM fix took effect. The Defiant's coverage of the same episode, and Snowbridge's own documentation on permissionless relaying, indicate that any operator could run a relayer, so halting Snowfork's relayers did not stop the flaw from being reachable. The two accounts agree on the outcome, that the containment was bypassed, but they describe the bypass differently and the sources do not fully reconcile the timing.
Fixes and Open Questions
Runtime 2.5.1 patched the XCM flaw on October 26. Runtime 2.5.2 followed on October 30 and reconciled dotUSD's supply accounting. The Defiant reported that the later upgrade fixed the stablecoin's supply records without changing any holder's balance, which is consistent with Parity's statement that no users lost funds.
Parity could not establish whether the person who exploited the vulnerability also profited from the arbitrage trades that followed. The identity of that beneficiary remains unresolved.
Why It Matters
For Traders
DOT and dotUSD pool depth may remain thin while supply accounting is reconciled, so watch liquidity conditions before sizing any position in the pair.
For Investors
The incident raises governance and security-process questions about a DAO-run stablecoin, and the gap between patch merge and deployment will matter for how the network's risk is assessed.
For Builders
Any protocol relying on XCM or cross-chain relayers should audit whether critical fixes reach production runtimes, and whether permissionless relayers can bypass emergency halts.
This article is for information only and is not financial advice. Read the full disclaimer.
