Another crypto hack drains out a billion tokens

According to Chainalysis, the industry lost $3.4 billion to crypto theft in 2025, with the top three hacks alone accounting for 69% of all losses.

Attackers have often targeted technical vulnerabilities in smart contracts and cross-chain bridges and on April 13, another such incident occurred.

An exploit on Hyperbridge, a cross-chain communication protocol built on the Polkadot (DOT) network, resulted in a loss of approximately $237,000.

The attacker manipulated a vulnerability in the gateway contract, the digital checkpoint that validates messages moving between blockchains, to fraudulently gain administrative control over Polkadot's token contract on Ethereum (ETH).

Related: CertiK’s Jason Jiang says every crypto hack can be stopped

Polkadot is a Layer 0 open-source blockchain platform and cryptocurrency that allows multiple blockchains, called parachains, to connect and operate within itself. It enables protocols and blockchains to their unique features while pooling their security, making it a scalable heterogeneous multi-chain technology.

If the broader blockchain world were a collection of isolated islands, with Bitcoin (BTC), Ethereum, and others, each operating under its own rules, they would be unable to communicate natively with one another. Polkadot is the bridge network that ensures this intercommunication.

A Layer 0 blockchain is the foundational infrastructure that Layer 1 blockchains are built on top of, or connect through. It does not run apps or process everyday transactions itself, unlike Bitcoin and Ethereum. Instead, it provides the underlying framework that makes multiple blockchains work together securely.

It was founded by Gavin Wood (who also co-founded Ethereum), Robert Habermeier, and Peter Czaban under the Web3 Foundation.

Billionaire slams Trump-linked company after losing $11M

Bessent, Powell AI risks in high-stakes meeting

Analyst slashes Coinbase rating, flags profitability concerns

Hyperbridge is a protocol designed to enable secure, verified communication between blockchains connected through Polkadot's ecosystem.

In this case, that verification broke down. The exploit exposed a specific edge case in the proof verification logic and insufficient checks in the admin-change function.

Security firm CertiK flagged the transaction and explained that the attacker submitted a forged "proof," recycling data from a previously legitimate transaction.