Polkadot’s treasury suffered a $1.38 million loss after an attacker leveraged a security flaw that had been fixed in the codebase months before the network’s new decentralized stablecoin, dotUSD, went live. Parity Technologies, the infrastructure team behind Polkadot and Kusama, disclosed that the bug was corrected in June but never reached the production environment before the October 24‑26 exploit, according to a report posted on November 2.

Vulnerability Origin and Misclassification

The flaw was initially classified as medium severity because Parity’s assessment did not consider its interaction with dotUSD, which had not yet launched. After the breach revealed a direct financial impact, the company upgraded the rating to critical. A security researcher had publicly referenced the code fix on October 20, later removing the comment after being told it violated Parity’s bug bounty policy, a disclosure that Parity believes may have aided the attacker.

How the Exploit Worked

The attacker targeted the Polkadot Asset Hub’s cross‑chain messaging (XCM) system, reducing the recorded supply of dotUSD without moving tokens from user accounts. This mismatch distorted the DOT/dotUSD liquidity pool, allowing the treasury—acting as the sole liquidity provider—to be drained of roughly $1.381 million through artificial pricing. Although the Treasury absorbed the loss, Parity confirmed that no user funds were compromised and dotUSD remained fully backed by USDT.

Emergency Measures and Aftermath

When suspicious activity was flagged on October 24, Snowfork halted its consensus relayers, temporarily blocking further malicious transactions via the Snowbridge bridge. The attacker circumvented this by operating an independent relayer on October 26, resuming the exploit six hours before Parity deployed runtime upgrade 2.5.1. A subsequent upgrade on October 30 corrected dotUSD’s recorded supply and restored the remaining liquidity. Parity said the incident exposed gaps in its security processes, prompting plans to strengthen vulnerability assessments, improve deployment checks, expand monitoring, and introduce an AI‑based framework to flag risky code changes earlier.

What to Watch Next

Observers will monitor how Polkadot’s revised security protocols perform during future upgrades, especially as the network expands its cross‑chain functionality. Additionally, the community will watch for any legal or governance responses within the OpenGov DAO concerning compensation mechanisms for treasury losses and potential reforms to the bug bounty program.