On April 13, 2026, Hyperbridge's Token Gateway was exploited via unbound Merkle proof verification and a zero-second challenge period. Attacker forged a cross-chain message, minted 1 billion bridged DOT, and liquidated for approximately $2.5M in ETH and incentive pool losses; funds traced to Binance and partially frozen.

Based on monitoring by CertiK Alert, the Hyperbridge gateway contract fell victim to an exploit. The attacker utilized forged messages to manipulate administrative permissions of the Polkadot token contract on the Ethereum network. By unauthorized minting and liquidating 1 billion tokens, the attacker realized a profit of roughly $237,000. On April 16, it was reported that according to an official announcement from Hyperbridge, its token gateway was attacked on April 13. The estimated losses have been revised from approximately $237,000 to about $2.5 million, mainly affecting incentive liquidity pools on Ethereum, Base, BNB Chain, and Arbitrum.