Polkadot lost $1.38 million after hacker exploited security flaw fixed four months earlier
Summary
An attacker exploited a Polkadot vulnerability that Parity had fixed in June but that had not been deployed to production. The flaw enabled manipulation of dotUSD’s recorded supply and prices in a DOT/dotUSD pool, costing Polkadot’s Treasury about $1.381 million. Parity said users lost no funds and dotUSD remained backed by USDT. After an initial containment effort was bypassed through an independent Snowbridge relayer, Polkadot deployed upgrades on Oct. 26 and Oct. 30, closing the vulnerability and correcting the supply record. Parity said it would strengthen security assessments, deployment checks and monitoring after acknowledging failures to account for risks introduced by dotUSD.
