Polkadot Treasury Loses $1.38 Million in dotUSD Exploit

Polkadot's Treasury lost $1.38 million after an attacker exploited a vulnerability in the network's dotUSD stablecoin system, according to CryptoSlate, which cited a Nov. 2 incident report from Parity Technologies.

Parity said the flaw had already been found and patched in its codebase in June, but the fix had not been applied to the production systems that were later attacked between Oct. 24 and Oct. 26. A security researcher posted a public forum comment referencing the code fix on Oct. 20, then deleted it after being told it broke Parity's bug bounty rules, per the report.

Suspicious activity surfaced on Oct. 24, leading Snowfork to pause its consensus relayers, but an independent relayer kept the exploit running for roughly six hours before developers shut it down. Parity pushed a runtime upgrade on Oct. 26 to close the hole and recover remaining liquidity, then issued a follow-up upgrade on Oct. 30 to fix dotUSD's recorded supply figure without touching individual account balances, the report said.

The Treasury was the only liquidity provider in the affected pool and absorbed about $1.381 million of the damage, Parity said, adding that no users lost funds and dotUSD stayed fully backed by USDT. The vulnerability was reclassified as critical after the incident, and Parity said it intends to tighten vulnerability reviews, deployment checks and monitoring for unusual asset issuance. The attacker's identity and how they gained access to run an independent relayer remain unconfirmed.