Polkadot Suffers $1.38 Million Treasury Loss Following Security Exploit

Blockchain infrastructure firm Parity Technologies disclosed that the Polkadot Treasury incurred financial losses totaling $1.38 million following a security breach tied to the decentralized stablecoin known as dotUSD. The digital asset debuted in October under the governance of the network's decentralized autonomous organization using the OpenGov framework, functioning without any centralized issuer.

Investigations revealed that the underlying security flaw had been identified and corrected within the codebase during June. However, the update failed to reach production environments prior to the attack that took place between October 24 and October 26. Initially, developers categorized the bug as a medium-severity issue because its potential interaction with the unlaunched stablecoin was overlooked. Following the financial fallout, the severity rating was upgraded to critical.

An earlier public disclosure on October 20 contributed to the incident when a security researcher posted a forum comment referencing the specific code fix. Although the comment was removed after violating bug bounty policies, developers suspect it provided sufficient details for attackers to identify and target the vulnerability. During the exploit, the perpetrator manipulated the Polkadot Asset Hub cross-chain messaging system to alter the recorded supply of dotUSD without removing actual user tokens.

This manipulation caused significant price distortions within the liquidity pool, enabling traders to exchange dotUSD for regular DOT at artificial rates. As the sole liquidity provider, the network Treasury absorbed the resulting losses. Parity confirmed that no regular users lost funds and that dotUSD remained fully backed by USDT. Meanwhile, Snowfork attempted to halt consensus relayers upon detecting suspicious activity on October 24, but the attacker operated an independent relayer on October 26 to resume the exploit before a formal security upgrade could be deployed.

Parity subsequently implemented runtime upgrade 2.5.1 on October 26 to close the vulnerability and secure the remaining liquidity. A subsequent upgrade on October 30 corrected the recorded supply of dotUSD without altering individual balances. In response to the breach, Parity announced plans to enhance deployment checks, expand monitoring for unusual asset issuance, and refine an automated security framework using artificial intelligence.

Polkadot Treasury lost $1.38 million after hackers exploited a vulnerability that was fixed months earlier.

Why it matters

This incident highlights critical challenges in multi-chain security coordination and the governance of decentralized stablecoins. For market participants tracking polkadot crypto developments, the event demonstrates how delayed deployment of known code corrections can introduce severe financial risks to network treasuries.