Worked example · 2026-04
Hyperbridge Merkle-proof forgery and counterfeit-DOT mint — Polkadot ⇄ Ethereum / Base / BNB / Arbitrum — 2026-04-13
Summary
Hyperbridge launched on Polkadot in November 2024 as a cross-chain bridge designed to enable trust-minimised message-passing between Polkadot and EVM chains via Merkle Mountain Range (MMR) proof verification. The Ethereum-side gateway contract was the load-bearing surface: it accepted MMR proofs over Polkadot consensus, verified them against committed state roots, and applied the verified messages to the Ethereum-side bridge state — including admin operations on the bridged-token contracts.
On 2026-04-13, an attacker exploited a flaw in the MMR proof verification logic that allowed an old, valid cryptographic proof from an earlier legitimate transaction to be accepted as authorisation for a different message. By pairing the outdated proof with a carefully crafted message that masqueraded as an authorised admin operation on the Ethereum-side DOT token contract, the attacker:
- Re-assigned admin authority on the bridged-DOT token contract to an attacker-controlled address.
- Used the acquired admin authority to mint 1 billion counterfeit bridged-DOT on Ethereum without depositing any backing DOT on Polkadot.
- Repeated the primitive against bridged-ARGN (~$1 billion notional minted), bridged-MANTA, and bridged-CERE across Ethereum, Base, BNB Chain, and Arbitrum.
- Cash-out via Uniswap into ETH; due to liquidity constraints in the destination pools, the realised cash-out was ~$237K initially (per same-day reporting) and ultimately revised to ~$2.5M as the full asset scope was reconciled (per Crypto Briefing updated estimate).
Polkadot's official forum confirmed the exploit within hours; Hyperbridge paused the protocol and shipped a patch over the following days. The native DOT token fell ~4% on the news; the counterfeit bridged-DOT was effectively worthless once the bridge was paused and the destination pools were drained.
The case is OAK's canonical T6.005 + T6.006 worked example because the upgrade-itself-as-attack-vector primitive is on full display: no operator keys were stolen, no pre-deployment social engineering occurred, and the bridge contract was the legitimate, audited deployment up to the moment the forged proof was accepted. The attacker's leverage was the on-chain message-verification logic, and the resulting admin-authority transfer was indistinguishable from a legitimate admin-rotation message at the contract layer.
Why this is structurally significant
T6.005 and T6.006 sit at an unusually clean intersection in this case: the proxy-upgrade-malicious-switching primitive (T6.005) was the mechanism by which the counterfeit-token-impersonation surface (T6.006) was opened. The two Techniques are structurally distinct but operationally chained.
Three structural features distinguish the Hyperbridge case within the broader proxy-upgrade-attack cohort:
The upgrade authority was reached via on-chain message forgery, not via pre-stolen keys. Steadefi (August 2023) lost $1.14M when an internal-key compromise gave the attacker access to the deployer EOA, which then upgraded the proxy implementation to a malicious one. The attack vector was the key compromise; the upgrade was the downstream extraction primitive. Hyperbridge inverts this: the attacker had no operator keys, the deployer EOA was uncompromised, and yet the attacker achieved the equivalent upgrade-equivalent admin-authority transfer via a forged cryptographic proof that the bridge accepted as a legitimate admin-rotation message. The detection-signal locus differs entirely: Steadefi's failure mode lives at the off-chain key-handling layer (operator-side key custody monitoring); Hyperbridge's failure mode lives at the on-chain message-verification layer (proof-uniqueness-vs-replay correctness).
The counterfeit-token leg is structurally different from typical bridge-token impersonation. The standard T6.006 sub-pattern is fake-symbol-matching deployment: a separate, unrelated contract is deployed with the symbol "USDC" or "WETH" and used in dust-attack lures or fake LP-token deposit drains. The Hyperbridge case is more severe: the counterfeit bridged-DOT was minted by the legitimate bridge contract, which made the counterfeit indistinguishable from legitimate bridged-DOT at the contract identity layer. Uniswap pools that quoted bridged-DOT would have priced the counterfeit identically to legitimate bridged-DOT — the impersonation succeeded at the protocol-identity layer, not just the symbol layer. This is the worst-case shape of T6.006.
The notional-versus-realised loss gap is structurally informative. $1.2B notional minted, ~$2.5M realised cash-out. The ratio reflects the destination-pool-liquidity constraint: counterfeit mints scale infinitely on the supply side, but the operator can only convert as much to ETH / stablecoins as the destination pools can absorb without crashing the price. T6.006 contributors should record both notional and realised loss; the ratio is a useful structural signal across the cohort.
The case generalises beyond Hyperbridge. Any bridge whose admin authority on destination-chain token contracts is gated by cross-chain-message verification is exposed to T6.005 + T6.006 chained extraction if the message-verification primitive admits forgery, replay, or signature-aliasing. Wormhole's 2022 uninitialised-implementation bug was the EVM-side analogue (different mechanism, same downstream); Audius 2022 was the storage-collision EVM-side analogue. Hyperbridge is the cross-chain-proof-forgery analogue, and the worked example completes the v0.1 reference set for the proxy-upgrade-attack cohort.
Timeline (UTC)
| When | Event | OAK ref |
|---|---|---|
| 2024-11 | Hyperbridge launches on Polkadot; Ethereum / Base / BNB Chain / Arbitrum gateway contracts deployed and operational | (genesis surface) |
| Pre-2026-04-13 | Bridge operates legitimately; multiple legitimate cross-chain admin / mint operations accumulate valid MMR proofs in the historical record | (standing T6.005 surface) |
| 2026-04-13 | Attacker reuses an outdated valid MMR proof, paired with a forged admin-rotation message, against the Ethereum-side bridged-DOT token contract; admin authority transfers to attacker EOA | T6.005 execution (proxy-upgrade-malicious-switching via proof forgery) |
| 2026-04-13 (within minutes) | Attacker uses acquired admin authority to mint 1 billion bridged-DOT on Ethereum; no backing DOT deposited on Polkadot | T6.006 execution (counterfeit-token mint) |
| 2026-04-13 (continuing) | Attacker repeats against ARGN (~$1B notional), MANTA, CERE across Ethereum, Base, BNB Chain, Arbitrum | T6.005 + T6.006 cohort scale-out |
| 2026-04-13 (within hours) | Attacker cash-out via Uniswap; ~$237K realised initially; pool liquidity constrains cash-out scale | T5 outflow |
| 2026-04-13 (same day) | Polkadot's official forum confirms exploit on Hyperbridge's Ethereum gateway contract; Hyperbridge pauses the protocol; native DOT falls ~4% ($1.22 → $1.18) | (defender response) |
| 2026-04-14 onward | The Defiant, Crypto Briefing, The Block, DL News, Cointelegraph, AMBCrypto, CoinDesk, CoinMarketCap (citing CertiK) publish forensic coverage triangulating the MMR-proof-reuse root cause | (forensic surface) |
| 2026-04 (revised estimate) | Crypto Briefing updates realised loss to ~$2.5M (~10× initial figure) once the full counterfeit-asset scope is reconciled | (loss-figure revision) |
| 2026-04 onward | Hyperbridge ships patch; protocol resumes operation under revised verification logic | (recovery / mitigation) |
What defenders observed
- Pre-event (proof-verification layer): the MMR-proof verification logic accepted any valid historical proof against the claimed message rather than binding the proof uniquely to a specific message via per-message commitment. The flaw was a classic message-verification-correctness gap: the cryptographic proof was valid; the binding between proof and message was not enforced. This was a standing T6.005 surface from the moment the gateway contract was deployed in November 2024. Defender lesson: cryptographic-proof-verification correctness is binary at the contract layer; auditors and bridge designers must verify what the proof commits to, not just that the proof is cryptographically valid.
- At-event (on-chain signal): the forged admin-rotation message produced an admin-transfer event on the bridged-DOT token contract from a non-deployer EOA, followed by mass-mint events with no corresponding deposit events on the Polkadot side. Either signal is detectable in real time by a bridge-monitoring indexer (admin-authority change without governance event; mint events without deposit-correlation). Hyperbridge did not have such monitoring in place at the time of the exploit; the public forum disclosure followed third-party detection rather than first-party telemetry.
- At-event (price-surface signal): native DOT fell ~4% on the news, anchored at the moment Polkadot's forum confirmed the exploit. The price reaction was bounded because the counterfeit was confined to bridged-DOT-on-EVM; native DOT on Polkadot was unaffected. The price-surface is therefore a secondary signal; the primary signal is the on-chain admin-authority-change event.
- Post-event: the counterfeit bridged-DOT was effectively worthless once the bridge was paused and Uniswap pool liquidity was withdrawn. The realised attacker profit (~$2.5M) is the upper-bound on cash-out within the available pool liquidity at the moment of execution. Operator-side response (Hyperbridge pause + patch) is the standard mitigation chain for a T6.005-class incident at the bridge layer.
What this example tells contributors writing future Technique pages
- T6.005 has at least two distinct sub-classes. Steadefi (August 2023, internal-key-compromise sub-class — see citation list below for adjacent reference) and Hyperbridge (this case, on-chain-message-forgery sub-class) share a downstream extraction primitive (proxy admin authority used to drain or mint) but have different upstream attack vectors. T6.005 contributors should preserve the sub-class distinction: the detection signals diverge entirely between off-chain key-handling monitoring (Steadefi-class) and on-chain message-verification correctness (Hyperbridge-class).
- T6.006 has at least three sub-classes. (a) Fake-symbol-matching deployment (separate unrelated contract sharing the symbol; canonical for dust-attack lures and fake LP-token deposit drains). (b) Bridge-impersonation via fake-bridge-token (a separate counterfeit deployment that masquerades as a legitimate bridged token; less severe than the Hyperbridge case). (c) Bridge-internal-mint (the legitimate bridge contract mints counterfeit tokens via attacker-acquired admin authority; the Hyperbridge case; the worst-case shape). T6.006 contributors should preserve the sub-class distinction.
- The notional-versus-realised loss gap should be recorded in T6.006 cases. The ratio reflects destination-pool-liquidity constraints and is a useful structural signal across the cohort. Forensic coverage that reports only the realised cash-out figure underestimates the attempted extraction scale by 1-3 orders of magnitude in this class.
- Cross-chain-proof-verification correctness is a v0.x-priority audit class. The Hyperbridge MMR-proof-reuse flaw is the canonical 2026 case; Wormhole's 2022 uninitialised-implementation bug and Audius's 2022 storage-collision are the EVM-internal analogues. The cross-cutting axis is contract-layer verification of authority-bearing messages; mitigation guidance should generalise across bridge and proxy patterns.
- Detection at the bridge-monitoring layer is straightforward where deployed. Admin-authority-change events without governance events; mint events without deposit-correlation. The defender intervention is bridge-side telemetry, not contract-layer rewrite. Future T6.005 / T6.006 examples should document whether the affected bridge had pre-event monitoring in place.
Public references
[thedefianthyperbridge2026](proposed) — The Defiant, "Polkadot Confirms Exploit on Hyperbridge's Ethereum Gateway Contract": https://thedefiant.io/news/hacks/polkadot-hyperbridge-ethereum-gateway-exploit-sjb0ql[cryptobriefinghyperbridge2026](proposed) — Crypto Briefing, "Polkadot bridge exploited, attacker seizes admin control to mint and dump 1B DOT tokens": https://cryptobriefing.com/polkadot-bridge-hyperbridge-exploit-dumps-dot/[cryptobriefinghyperbridgejump2026](proposed) — Crypto Briefing, "Polkadot linked Hyperbridge exploit losses jump to $2.5 million": https://cryptobriefing.com/token-gateway-exploit-impact/[theblockhyperbridge2026](proposed) — The Block, "Attacker exploits Polkadot-based Hyperbridge to mint 1 billion bridged DOT, nets $237K": https://www.theblock.co/post/397167/bridged-dot-hyperbridge-exploit[dlnewshyperbridge2026](proposed) — DL News, "A hacker created $1.2bn of counterfeit crypto. They only sold it for $237,000": https://www.dlnews.com/articles/defi/a-hacker-created-dollar12bn-of-counterfeit-crypto-they-only-sold-it-for-dollar237000/[cointelegraphhyperbridge2026](proposed) — Cointelegraph, "Hacker Steals $237K after Minting 1B Bridged DOT on Hyperbridge": https://cointelegraph.com/news/hacker-steals-237k-1b-bridged-dot-hyperbridge[ambcryptohyperbridge2026](proposed) — AMBCrypto, "Hyperbridge exploit lets attacker mint 1B bridged DOT — raising questions after 'safest bridge' claims": https://ambcrypto.com/hyperbridge-exploit-lets-attacker-mint-1b-bridged-dot-raising-questions-after-safest-bridge-claims/[coindeskhyperbridge2026](proposed) — CoinDesk, "Attacker mints $1 billion Polkadot tokens on Ethereum, steals just $250,000": https://www.coindesk.com/tech/2026/04/13/attacker-mints-usd1-billion-polkadot-tokens-on-ethereum-ends-up-stealing-just-usd250-000[cmcacademyhyperbridge2026](proposed) — CoinMarketCap Academy citing CertiK research, "Hyperbridge Exploit Mints 1B DOT Tokens in Attack": https://coinmarketcap.com/academy/article/hyperbridge-exploit-mints-1b-dot-tokens-in-attack-certik-reports[polkadotforumhyperbridge2026](proposed) — Polkadot Forum first-party disclosure: https://forum.polkadot.network/t/we-re-aware-of-an-issue-affecting-hyperbridges-ethereum-gateway-contract/17504[autheobridgesecurity2026](proposed) — Autheo Blog, "Bridge Security After the Hyperbridge Exploit: Mint Controls, Liquidity Limits, and Incident Response": https://www.autheo.com/blog/bridge-security-lessons-hyperbridge-exploit-2026
Discussion
The Hyperbridge case is the canonical 2026 worked example for the upgrade-itself-as-attack-vector sub-class of T6.005 (Proxy-Upgrade Malicious Switching). The case is structurally cleaner than Steadefi (August 2023, internal-key-compromise sub-class) because no off-chain operator key was compromised — the entire attack chain lives at the on-chain message-verification layer. This makes Hyperbridge the right anchor for the contract-layer sub-class of T6.005, while Steadefi anchors the operator-key sub-class.
The case is also the canonical worked example for the bridge-internal-mint sub-class of T6.006 (Counterfeit Token Impersonation). The standard T6.006 pattern is fake-symbol-matching deployment — a separate, unrelated contract is deployed with the symbol "USDC" or "WETH" and used in dust-attack lures or fake LP-token deposit drains. The Hyperbridge sub-class is more severe because the counterfeit was minted by the legitimate bridge contract: at the protocol-identity layer, the counterfeit bridged-DOT was indistinguishable from legitimate bridged-DOT.
The triangulation across The Defiant, Crypto Briefing, The Block, DL News, Cointelegraph, AMBCrypto, CoinDesk, CoinMarketCap (CertiK), and AMBCrypto is unusually clean for a v0.1 case — multi-source coverage of the technical root cause (MMR-proof reuse), the realised-vs-notional loss accounting ($2.5M realised vs $1.2B notional), and the protocol-side response (pause + patch + Polkadot forum first-party disclosure). The case meets the v0.1 standard for "verified across at least 2 independent forensic providers" with substantial margin.
For OAK's broader cohort coverage, this case + the Solana PD burn-on-buy cohort (examples/2024-09-solana-permanent-delegate-burn-on-buy-cohort.md) + the cross-chain honeypot cohort (examples/2024-02-honeypot-token-cohort-cross-chain.md) collectively establish that the fake / honeypot / malicious-by-design smart contract cohort is a cross-chain pattern with structurally distinct sub-surfaces per chain ecosystem and per primitive (genesis-time hostile bytecode vs runtime-time hostile authority change vs cross-chain message-forgery). The cohort motivates the T1.006 / T1.007 / T6.005 / T6.006 sub-Technique proposals in TAXONOMY-GAPS.md.