Polkadot Treasury loses $1.38 million to exploit

The Polkadot Treasury lost approximately $1.38 million in DOT following a security exploit that occurred between October 24 and October 26, 2026. An attacker targeted a vulnerability in the Cross-Consensus Messaging (XCM) executor of the Polkadot Asset Hub, the parachain dedicated to assets that hosts a decentralized exchange (DEX).

The exploit involved a specific instruction, “WithdrawAsset”. When an XCM program failed, account debits were canceled, but the recorded decrease in the total supply of the dotUSD stablecoin remained. By repeating this process, the attacker artificially lowered the official supply of dotUSD without affecting actual user balances. This discrepancy caused the DOT/dotUSD liquidity pool to overvalue dotUSD, allowing the attacker to exchange the stablecoin for significantly more DOT than its actual value.

Parity Technologies reported that the security flaw had been identified and a fix was implemented in June, but the update had not reached the affected production systems before the attack. The vulnerability was initially classified as medium severity, but was later upgraded to critical after the financial impact was realized. The breach followed a public forum comment by a security researcher regarding the code fix, which developers believe may have provided attackers with the information needed to exploit the system.