Between October 24 and 26, 2026, an attacker exploited a bug in the XCM executor on Polkadot Asset Hub to reduce the recorded issuance of dotUSD without changing underlying account balances, breaking the assumption that recorded issuance equals the sum of all balances. This distorted pricing in the DOT/dotUSD pool and enabled arbitrage trades at an artificial rate. The Polkadot Treasury, as the sole liquidity provider, lost an estimated $1.381 million in DOT value. No user funds were lost. The vulnerability was reported via bug bounty and fixed in the codebase in June 2026 but was not deployed to the affected production runtime in time.