Polkadot Post-Mortem on XCM Vulnerability Incident: Treasury Loses Approximately $1.381 Million

on November 5, according to a Polkadot forum post-mortem, between October 24 and 26, an attacker exploited a vulnerability in the Asset Hub's XCM executor to reduce the accounting issuance of dotUSD without altering account balances, causing a pricing imbalance in the DOT/dotUSD liquidity pool. As the sole liquidity provider for this pool, the Treasury suffered losses estimated at approximately $1.381 million in DOT, while user funds remained uncompromised.

The post-mortem was released on November 2. The vulnerability was reported through a bounty program in June and patched in the codebase, but the patch was not included in the affected production build. Following an on-chain upgrade that deployed the fix on October 26, the team recovered the remaining liquidity in the pool, and a subsequent upgrade on October 30 corrected the accounting issuance of dotUSD.