Polkadot’s Treasury lost about $1.381 million in an Oct. 24–26, 2026 attack on its dotUSD trading pool. Parity Technologies said it had fixed the underlying vulnerability in its codebase in June, but the fix had not reached the affected production systems. Parity said no users lost funds and dotUSD remained fully backed by USDT; it could not determine whether the attacker also profited from later arbitrage trades.
The attacker manipulated cross-chain messages to reduce dotUSD’s recorded supply without removing tokens from user accounts, distorting pool prices. Snowfork halted its own relayers after detecting suspicious activity, but the attacker used an independent relayer to resume the exploit on Oct. 26. An Oct. 26 upgrade closed the flaw, and an Oct. 30 upgrade corrected the recorded supply without changing account balances. Parity said an Oct. 20 public comment about the earlier fix may have helped the attacker, but that link is unproven.
