Polkadot

What happened

Between October 24 and 26, 2026, an attacker exploited a bug in the XCM executor on Polkadot Asset Hub to reduce the recorded issuance of dotUSD without changing underlying account balances, breaking the assumption that recorded issuance equals the sum of all balances. This distorted pricing in the DOT/dotUSD pool and enabled arbitrage trades at an artificial rate. The Polkadot Treasury, as the sole liquidity provider, lost an estimated $1.381 million in DOT value. No user funds were lost. The vulnerability was reported via bug bounty and fixed in the codebase in June 2026 but was not deployed to the affected production runtime in time.

Details

Date

Oct 24, 2026

Kind

Hack or exploit

Method

XCM Executor Vulnerability

How in

Smart contract bug

Target

Blockchain itself

Chains

not stated

What would have stopped it all controls for this way in

• Every function that moves funds or changes roles checks who calls it.
  Check: A list of privileged functions with a test per function that a stranger's call reverts.
• Invariants (solvency, supply, share price) are written down and fuzzed or proven on every function that changes a balance.
  Check: An invariant suite runs in CI; each balance-changing function is covered.
• A whitehat Safe Harbor or bounty offer is published before any attack, so a rescuer or an attacker has a set way to return funds.
  Check: The terms and the return address are public and fixed in advance.

General guidance for this kind of attack, not a finding about this incident.

How sure: 0 of 4 checks what the checks mean

• Witnessesone source so far
• Same storyneeds a second source
• Blockchain receiptno public attack transaction checked
• Official wordno official statement linked

Who says what

• SlowMist Hacked ↗$1.4M

Figure used: $1.4M, the figure SlowMist Hacked gives. Each source's own figure is in dollars at the time.