Polkadot Loses $1.38M from Treasury in October XCM Exploit; Code Was Fixed in June but Not Deployed in Time

November 5: The Polkadot forum published a post-mortem of an XCM incident, showing that a vulnerability in the XCM executor on Polkadot Asset Hub was exploited from October 24 to 26. The attacker reduced dotUSD's ledger issuance without changing account balances, distorting pricing in the DOT/dotUSD pool and creating arbitrage opportunities, causing an estimated loss of about $1.381 million in DOT value. Polkadot Treasury was the pool's sole liquidity provider, and no user funds were lost.

The post-mortem noted that the vulnerability had been reported through the bug bounty program in June and a fix had been completed in the codebase, but the fix was not deployed in time to the affected mainnet runtime version. On October 20, the reporter publicly mentioned the related fix on the forum, which may have provided the attacker with a clue. After the incident, Polkadot remediated the issue through Runtime 2.5.1 and 2.5.2, correcting the dotUSD supply, and the recovered funds have been returned to the Treasury.