Hyperbridge Hack

On April 13, 2026, Hyperbridge's Token Gateway on Ethereum lost $237K when an attacker exploited missing input validation in the Merkle Mountain Range proof verifier. The flaw allowed forged proofs to pass verification, granting the attacker admin control to mint 1 billion bridged DOT tokens (2,800x the legitimate supply) and dump them on DEXs. Only bridged DOT on Ethereum was affected.

The vulnerability existed in Hyperbridge's Solidity implementation of Merkle Mountain Range proof verification within the HandlerV1 contract. The VerifyProof() function failed to validate that leaf_index was less than leafCount. When an attacker submitted a proof with leafCount set to 1 and leaves[0].leaf_index also set to 1, the root calculation bypassed the actual leaf hash values (which contained request information) and accepted the attacker's submitted multiproof value directly.

This allowed the attacker to forge invalid proofs that the system incorrectly validated as legitimate. The TokenGateway's handleChangeAdmin() function checked the request source against stored addresses, but the attacker could arbitrarily input values in the request structure. The malicious request passed unchecked from Handler to Host to Gateway, granting the attacker administrative control over the bridged DOT token contract on Ethereum.

With admin access, the attacker minted 1 billion bridged DOT tokens. The legitimate circulating supply was only about 356K tokens, making this a 2,800x inflation. The attacker then sold the minted tokens on decentralized exchanges for approximately $237K before detection. Hyperbridge immediately paused all bridging operations. Native DOT on Polkadot relay chain, parachains, and other bridged assets remained completely secure.