Polkadot Treasury Loses $1.38M to XCM Bug Fixed in June

An attacker exploited a bug in the XCM executor, Polkadot's cross-chain messaging system, and drained about $1.381M in DOT from a Polkadot Treasury liquidity pool. The attack ran October 24⁠–⁠26, and the development team published its incident review on November 2. User funds were not affected, and dotUSD stayed fully backed.

Details

According to the incident review posted by developer bkchr on the Polkadot forum, the WithdrawAsset instruction correctly reverted account debits when an error occurred, but the change to the recorded total supply persisted. The reported dotUSD issuance shrank while actual balances stayed the same, breaking a core assumption of the protocol.

The distorted accounting skewed dotUSD pricing on the DEX. The Peg Stability Module kept converting dotUSD to USDT one-to-one, so the attacker could profit from the gap. The Polkadot Treasury was the only liquidity provider in the DOT/dotUSD pool and absorbed the entire loss.

The fix was merged in June 2026 (PR #11910) but missed the stable-2606 release cutoff. Runtime 2.5.1 with the XCM fix was proposed on October 24 (referendum 1960), and runtime 2.5.2, which corrected the recorded dotUSD supply, was approved on October 30 (referendum 1961). CryptoSlate reports that the attacker's identity is unknown and that a public forum comment referencing the fix on October 20 was later removed.

What it means for the market

The sum is small for a network of Polkadot's size, but the case shows the cost of release delays: the flaw was fixed in code four months before the attack and never reached production. For users, the key point is that dotUSD remains fully backed by USDT and the loss was covered by the Treasury.

More on DOT on the coin page; live prices are in the daily brief.