Digital Asset
Intelligence
Security Incident · Polkadot Ecosystem

Polkadot XCM Executor Vulnerability: $1.38M Reported Loss

·Source-attributed incident record

Incident Overview

Between October 24 and 26, 2026, an attacker exploited a bug in the XCM executor on Polkadot Asset Hub to reduce the recorded issuance of dotUSD without changing underlying account balances, breaking the assumption that recorded issuance equals the sum of all balances. This distorted pricing in the DOT/dotUSD pool and enabled arbitrage trades at an artificial rate. The Polkadot Treasury, as the sole liquidity provider, lost an estimated $1.381 million in DOT value. No user funds were lost. The vulnerability was reported via bug bounty and fixed in the codebase in June 2026 but was not deployed to the affected production runtime in time.

Sources & References

Original incident referencehttps://forum.polkadot.network/t/xcm-incident-review-what-happened-and-what-we-learned/19207 (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Attack methodPrivate Key Leakage
    Reported loss$ 20000
  2. Incident date
    Target

    Interlay

    Attack methodAccount Compromise
    Reported lossNot disclosed
  3. Incident date
    Target

    Acala

    Attack methodOn-chain setup error
    Reported loss$ 52,000,000
  4. Incident date
    Target

    X100

    Attack methodFlash Loan Governance Attack
    Reported loss$ 4,850,000
  5. Incident date
    Target

    Initia

    Attack methodZero-day vulnerability
    Reported loss$ 2,700,000