CryptoMediumUpdated•Originally published 4 November 2026•Updated 4 November 2026•
1 min read
Polkadot Exploit Targeted Asset Hub and Treasury-Funded Trading Pool
Key Facts
1Polkadot lost $1.38 million after a hacker exploited a security flaw that had been fixed four months earlier.
2The attacker began operations on October 26 using their own relayer before the XCM fix was implemented.
The recent security exploit on the Polkadot network targeted the Asset Hub's cross-chain messaging system, distorting the value of a Treasury-funded trading pool. CryptoSlate reported that the attacker utilized a flaw in the XCM protocol that had been patched four months prior, resulting in a loss of $1.38 million in DOT value.
The breach occurred on October 26, 2026, as the attacker used a private relayer to bypass security protocols before the fix was fully integrated across the network. This specific targeting of Treasury-funded liquidity pools highlights persistent vulnerabilities in cross-chain communication mechanisms despite the flaw being previously identified.