Between October 24 and 26, 2026, an attacker exploited a flaw in Polkadot’s Asset Hub XCM executor to artificially inflate the value of the dotUSD stablecoin on the network’s decentralized exchange. The manipulation enabled the withdrawal of approximately $1.38 million in DOT from the DOT/dotUSD pool, for which the Polkadot treasury was the sole liquidity provider. User balances were not affected, and the 1:1 conversion between dotUSD and USDT remained guaranteed. The flaw had been reported and patched in the source code in June 2026, but the fix had not been deployed on the network before the attack. Parity ultimately deployed an Asset Hub update on October 26 and announced stronger vulnerability assessments, faster patch deployments and enhanced monitoring of asset issuance.
Source: Read the original article
