Polkadot Treasury Loses $1.38 Million Due to Delayed XCM Security Patch

The Polkadot ecosystem has released a detailed post-mortem regarding a security incident on the Polkadot Asset Hub that resulted in a loss of approximately $1.381 million in DOT tokens from the network’s Treasury. The vulnerability, which affected the Cross-Consensus Messaging (XCM) executor, was exploited between October 24 and 26, 2026. While the security flaw had been identified and fixed in the codebase as early as June 2026, the patch was not deployed to the production environment in time to prevent the attack.

Mechanism of the XCM Exploit and Arbitrage

The incident centered on a logic flaw in the XCM executor that allowed an attacker to manipulate the recorded issuance of dotUSD, Polkadot’s decentralized stablecoin. By repeatedly triggering specific XCM instructions, the exploiter was able to decrease the total supply record of dotUSD without actually reducing the balances in individual user accounts.

This accounting discrepancy directly impacted the DOT/dotUSD liquidity pool on the Asset Hub’s decentralized exchange. Because the pool’s pricing mechanism relied on the recorded supply of tokens, the artificial reduction in supply distorted the exchange rate. This created lucrative arbitrage opportunities, allowing traders to acquire DOT at significantly undervalued rates.

• Affected Period: October 24 to October 26, 2026.
• Total Loss: Estimated at $1.381 million worth of DOT.
• Impacted Entity: The Polkadot Treasury was the sole liquidity provider for the pool.
• User Funds: No individual user funds were lost or compromised during the event.

Deployment Delays and Public Disclosure

A critical finding in the post-mortem report is that the vulnerability had been reported through Parity’s bug bounty program in June 2026. Although a fix (PR#11910) was merged into the codebase on June 25, it missed the stable-2606 release cutoff and was not included in the active production runtimes.

Initially, the flaw was classified as "Medium" severity because dotUSD had not yet launched, and its potential financial impact was underestimated.

The situation was further complicated on October 20, when the original bug reporter publicly mentioned the fix on the Polkadot Forum. While the comment was later removed for violating bug bounty terms, developers believe the disclosure may have inadvertently provided the attacker with the necessary clues to identify the unpatched vulnerability in the live network.

Remediation and Governance Response

Following the detection of suspicious activity, ecosystem partners including Snowfork temporarily halted relayers to slow the attack. The Polkadot Technical Fellowship subsequently fast-tracked Runtime 2.5.1 via an OpenGov referendum, which was applied on October 26 to close the security hole. A follow-up upgrade, Runtime 2.5.2, was enacted on October 30 to reconcile the dotUSD supply records based on actual account balances.

"The underlying bug has been fixed, and the impacted assets were moved to a controlled account to prevent further extraction. It did not affect user wallets or funds", stated the official incident review published on the Polkadot Forum.

The incident has prompted a review of the network's security procedures. The Polkadot community and Parity Technologies are now focusing on enhancing the release cycle for critical patches and refining the severity assessment protocols for new asset launches within the ecosystem.