Polkadot reported a $1.3 million loss from an XCM flaw
BROBROK News · Based on reporting by DiarioBitcoin ·
Polkadot said an attacker exploited an XCM vulnerability that had been fixed in code months earlier, but the patch had not reached the affected production runtimes. The estimated loss was about $1.3 million for the network treasury, while Parity said no users lost funds.
Key points
- The issue was fixed in June 2026, but the production patch was not deployed in time.
- The exploit ran from October 24 to October 26 and affected the DOT/dotUSD pool.
- Polkadot’s treasury was the pool’s only liquidity provider and absorbed the losses.
- Parity said dotUSD remained fully backed by USDT.
- Runtime 2.5.1 was deployed on October 26, followed later by 2.5.2 to reconcile dotUSD supply records.
Why it matters
This case shows that a code fix does not remove risk unless it is actually deployed to production. For crypto investors, it also highlights how infrastructure changes can increase the impact of an otherwise known issue.
Original headline: “Polkadot perdió cerca de USD $1,3 millones por una falla corregida que no llegó a producción”
Read the original on DiarioBitcoin
Summary and analysis written by BROBROK News from the original report. Read the full story on the source website. Not investment advice.