Polkadot Asset Hub dotUSD pool via XCM bug (October 2026) hack — October 2026

Between 24 and 26 October 2026 an attacker used a bug in the XCM executor on Polkadot Asset Hub to cut the recorded supply of dotUSD, the DAO-governed stablecoin Polkadot launched that month, without touching any account balance. A failed XCM program that withdrew dotUSD reverted the account debit correctly but kept the reduction in total supply, and repeating it pushed recorded supply below what the Hub’s DOT/dotUSD pool actually held. The Hub’s exchange caps a pool’s usable balance at the asset’s recorded supply, so the pool’s price broke and traders could swap dotUSD for DOT at an artificial rate. The messages arrived from Ethereum through Snowbridge, but Parity says the bug was in the XCM executor and reproduced it without the bridge.

Parity Technologies’ incident review of 2 November puts the loss at about $1.381 million in DOT, borne by the Polkadot Treasury, the pool’s only liquidity provider. No user lost funds and dotUSD stayed backed 1:1 by USDT. Parity says the on-chain evidence has not shown that whoever exploited the bug also profited from the arbitrage that followed. The bug had been reported through Parity’s bug bounty in June and fixed in the codebase, rated medium severity because dotUSD did not exist yet, but the fix missed a release cut-off and never reached the affected runtimes. Parity believes a forum comment by the reporter on 20 October that referenced the fix may have pointed attackers to it.

When partners flagged the activity on 24 October, Snowfork halted its own Snowbridge relayers, which paused the attack, and runtime 2.5.1 with the fix went to an OpenGov referendum the same day. On 26 October the attacker ran its own relayer and resumed about six hours before the upgrade took effect; Parity then rescued the liquidity left in the pool and returned the recovered dotUSD to the Treasury. Runtime 2.5.2, enacted on 30 October, corrected the recorded supply from account balances. Nothing taken has been returned.