A bug in Polkadot’s cross-chain messaging code cost the Polkadot Treasury about $1.381 million in DOT, according to an incident review that Parity Technologies posted on the Polkadot forum on 2 November. The flaw was reported through Parity’s bug bounty in June and a fix was merged that month, but it missed a release cut-off and was not running on the network when it was exploited between 24 and 26 October.
Parity says “No users lost any funds”. The loss fell on a DOT/dotUSD trading pool on Polkadot Asset Hub in which the Treasury was the only liquidity provider. Parity also says dotUSD “remained fully backed throughout the incident”.
In brief
- Holders of dotUSD lost no balances, Parity says, and minting and redemption against USDT stayed at 1:1 through its Peg Stability Module.
- An XCM executor bug let an attacker cut dotUSD’s recorded supply without touching balances, which distorted pool prices.
- Runtime 2.5.1 fixed the bug on 26 October; runtime 2.5.2, enacted on 30 October, corrected the recorded supply.
What dotUSD holders need to know
Parity’s review says the bug “did not remove dotUSD from account balances”. What it did change was the recorded total supply of the token. Because that figure fell below real balances, it “restricted redemption capacity pending a correction”.
That correction is now done. Runtime 2.5.2 “corrected dotUSD’s recorded supply using existing account balances, without changing individual balances”, Parity says, and was approved and enacted through OpenGov on 30 October. The v2.5.2 release notes say dotUSD is frozen while a migration recomputes its total issuance, and the code change states that “no balance is changed”. In a test run included with that change, the recorded supply before the fix was only about 3.7% of the sum of account balances.
dotUSD is the network’s own stablecoin, launched through an OpenGov vote in October. As TSN reported at launch, its first phase is minted one-for-one against USDT up to a cap, and Treasury funds seeded a DOT/dotUSD pool.
How the XCM bug was exploited
XCM is the message format Polkadot chains use to move assets. XCM programs are meant to be all-or-nothing: if one fails, none of its changes should stick. Parity says this did not hold “in certain circumstances”. An attacker built a program with a WithdrawAsset instruction that rolled back account debits on failure but kept the matching cut to the recorded total supply. Repeating it drove the recorded supply down.
The Asset Hub exchange capped the dotUSD it treated as available in the pool at the lower of the pool’s balance and the token’s recorded supply. Once recorded supply fell below the pool’s real balance, prices went wrong. That opened an arbitrage: swap dotUSD for DOT at an artificial rate in the pool, then mint or redeem at 1:1 against USDT elsewhere.
The messages came from Ethereum through Snowbridge, but Parity says the bug was in the XCM executor, not the bridge, and it reproduced the behaviour without the bridge. Parity also says on-chain evidence “has not established that the attacker who exploited the XCM vulnerability also profited from the subsequent arbitrage”.
How a June fix missed the release
The fix, PR #11910, titled “XCM hardening – fix some regressions”, was merged into the Polkadot SDK on 25 June. It was rated medium severity at the time. Parity says that rating “did not account for the interactions with dotUSD, which had not yet launched”. The fix missed the stable-2606 release cut-off and was not in the runtimes in use.
On 20 October, Parity says, the researcher who reported the bug posted a public forum comment pointing to PR #11910, breaching the bounty terms. The comment was deleted a few hours later. Parity believes it “may have provided attackers with sufficient context”. A backport of the fix to the stable-2606 line was merged on 22 October.
Partners raised the alarm on 24 October. Snowfork, the team behind Snowbridge, halted its relayers the same day, pausing the attack, and runtime 2.5.1 with the fix was put to an OpenGov vote. Its release notes list “Apply XCM hardening from polkadot-sdk#13531”. On 26 October the attacker ran its own relayer and resumed, about six hours before the upgrade went live. Parity then pulled the remaining liquidity from the pool, and the recovered dotUSD went back to the Treasury.
A medium bug turned critical when dotUSD launched
The most useful line in Parity’s review is that the bug’s impact “changed as new functionality was introduced”. In June the flaw looked moderate. By October, a new stablecoin and a Treasury-funded pool sat on top of it, and the same bug became worth more than a million dollars. Bug ratings are snapshots. They need revisiting each time a network adds something that leans on the affected code.
The second lesson is about the gap between a merged fix and a deployed one. Open-source code is public, so a merged security fix is a signpost to anyone who reads pull requests. Parity blames a public comment for giving attackers context, but the fix itself sat in the open for four months. That is the same weakness Hacken flagged when it counted unpatched public fixes among the main routes for Q3 crypto losses.
Parity’s plan targets both points: reassessing findings as features change, simpler release and backport steps, checks that fixes reach live runtimes, and monitoring for odd changes in asset supply. It also says it uses an automated agentic framework to analyse pull requests. These are sensible steps, but they come after the loss.
The incident is also a test of on-chain governance under pressure. A fix needed a vote, the attacker had a window while it ran, and a single Treasury-funded pool carried the cost. Polkadot users have seen supply-chain trouble this autumn too, with the Fearless Wallet extension leaking private keys. OpenGov voters will now judge whether the review’s promised changes go far enough.
Sources
- Parity Technologies, “XCM Incident Review: What happened and what we learned”, Polkadot forum, 2 November 2026
- paritytech/polkadot-sdk PR #11910, “XCM hardening – fix some regressions”, merged 25 June 2026
- paritytech/polkadot-sdk PR #13531, stable2606 backport of #11910, merged 22 October 2026
- polkadot-fellows/runtimes release v2.5.1, published 24 October 2026
- polkadot-fellows/runtimes release v2.5.2, published 28 October 2026
- polkadot-fellows/runtimes PR #1334, “Asset Hub Polkadot: reconcile total issuance with account balances”, merged 28 October 2026
Related stories
- Stablecoins and Tax Under Pressure: ESMA’s Warning, a Senator’s Letter and Greece’s 10% Plan
- Fearless Wallet Extension Leaked Users’ Private Keys, Polkadot Says
- Hacken: Crypto Hacks Cost $1.18bn in Q3 2026, Mostly via Suppliers
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
