Hyperbridge (Polkadot-Ethereum Bridge) — April 2026 Exploit
Summary
Hyperbridge is a cross-chain interoperability protocol developed by Polytope Labs that bridges the Polkadot and Ethereum ecosystems using cryptographic proof verification. On April 13, 2026, an attacker exploited a missing bounds check in the Merkle Mountain Range (MMR) proof verifier within the HandlerV1 contract, forging cross-chain governance messages that granted administrative control over the bridged DOT token contract on Ethereum; the attacker subsequently minted 1 billion bridged DOT tokens and dumped them across decentralized exchanges. Losses were initially reported at approximately $237,000 but were revised to approximately $2.5 million after forensic analysis revealed the attack spanned four EVM networks — Ethereum, Arbitrum, Base, and BNB Chain.
Connected Entities
1 entities · 10 linked investigationsTimeline(11 events)
2023-01-01
Seun Lanlege and David Salami co-found Polytope Labs, the developer of Hyperbridge
Technext / People of Color in Tech2024-01-01
Hyperbridge launches on Polkadot mainnet, marketed as offering cryptographic 'full node security' for cross-chain bridging
AMBCrypto2026-04-13
Attacker exploits missing bounds check in HandlerV1 VerifyProof() function at 03:55:23 UTC, forging a governance message to seize admin control of bridged DOT token contract on Ethereum; 1 billion bridged DOT tokens minted and dumped for approximately 108.2 ETH (~$237,000); Hyperbridge pauses all bridging operations
Hyperbridge Blog / DARKNAVY / CoinDesk2026-04-13
South Korean exchanges Upbit and Bithumb suspend DOT deposits and withdrawals as a precautionary measure; native DOT price falls approximately 4%
Phemex2026-04-16
Hyperbridge deploys the OutOfBoundsLeaves invariant fix; revises total realized losses to approximately $2.5 million — ten times the initial estimate — after forensic reconciliation across Ethereum, Arbitrum, Base, and BNB Chain
Hyperbridge Blog / The Block / CryptoTimes2026-04-17
Internal audit begins, discovering additional duplicate/unsorted leaf vulnerabilities beyond the initial exploit vector
Hyperbridge Blog Post-Mortem2026-04-21
Hyperbridge files disclosure with Parity Technologies; pallet-beefy-mmr patched to address the same underlying MMR flaw in upstream Polkadot libraries
Hyperbridge Blog Post-Mortem2026-04-27
Fork of rs-merkle deployed for off-chain prover with corrected MMR implementation
Hyperbridge Blog Post-Mortem2026-05-11
Hyperbridge v1.0.0 released; redeployment commences after all 14 SRLabs audit findings remediated
Hyperbridge Blog Post-Mortem2026-05-15
Hyperbridge launches public bug bounty program on HackenProof with rewards up to $50,000 for critical vulnerabilities
CryptoTimes2026-06-16
Hyperbridge relaunches as 'Interoperability Hyperstructure' with new Hyper Fungible Token standard, OFT adapter for LayerZero, permissionless provers, and removal of sudo functions; over $150,000 in bug bounties distributed to 20+ researchers during rebuild
Technext / Hyperbridge BlogDecision Log
- #1publish⛓ pending8/2/2026, 12:19:49 PMhash: AL8kosR4WK6LMy46svxqdFMTo4zR5Kp4tmtAJjtq9Xhn
25 of 27 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/2/2026, 12:19:37 PM
last updated: 8/2/2026, 7:33:28 PM
avoid.net — verified advice for a post-truth world