Skip to main content
• 3 min read

Hyperbridge Cross-Chain Gateway Suffers Proof
Replay Attack, Resulting in Approximately $237,000 Loss

According to monitoring by CertiK Alert, **Hyperbridge** has been exploited due to a code logic vulnerability. The attacker leveraged a flaw in how the gateway contract processes specific proofs to **replay** a historical legitimate proof. By doing so, the hacker seized **administrative privileges** (Admin rights) of the Polkadot token contract on Ethereum, subsequently **minting** and dumping 1 billion tokens to realize illicit profits.

AUTOSEC.DEVAUTOSEC.DEV
Hyperbridge Cross-Chain Gateway Suffers Proof Replay Attack, Resulting in Approximately $237,000 Loss
  • Attack Date: April 13, 2026
  • Target: Hyperbridge Gateway
  • Target Overview: Hyperbridge is a cross-chain interoperability protocol. The exploit targeted its Ethereum-based gateway contract which manages cross-chain asset instructions.
  • Total Loss: ~$237,000
  • Attack Vector: Logic Vulnerability

Incident Review & Technical Details​

1. Attack Path​

  • MMR Algorithm Flaw: The root cause was located in the MerkleMountainRange.CalculateRoot() function. When the leafCount was equal to 1, the algorithm failed to properly bind the submitted "proof" to the specific "request" data.
  • Proof Replay: Because the binding was broken, the attacker was able to copy a valid _stateCommitments value from a previous, legitimate transaction and "replay" it as proof for a new, malicious request.
  • Authorization Bypass: The handleChangeAdmin() function in the TokenGateway checked the request.source. However, since the attacker could arbitrarily define the request body, they simply input a trusted source address to pass the check.
  • Privilege Escalation: The malicious payload in incoming.request.body passed through the Handler and Host to the Gateway unchecked. This allowed the attacker to successfully change the Admin of the Polkadot token contract to their own address.

2. Impact Scope​

Once the attacker gained Admin rights, they minted 1 billion tokens and immediately sold them on decentralized exchanges. While no funds were directly "stolen" from the contract's vault, the massive sell pressure caused significant slippage and a loss of ~$237k in market value.

3. Official Verdict​

The incident is classified as a logic implementation error within the cross-chain component's Merkle proof verification system, specifically failing to handle single-leaf scenarios securely.

4. Investigation & Recommendations​

Recommend that all cross-chain protocols ensure a strict cryptographic binding between the proof and the leaf data. Developers should specifically audit "edge cases" (like leafCount == 1) where standard recursive hashing might be skipped or simplified.

AUTOSEC.DEV Solution: Building a 360-Degree Defense​

To counter hybrid attacks involving "Web2 Breach + Web3 Monetization," AUTOSEC.DEV provides comprehensive protection from code to personnel:

  1. Team OPSEC (Operations Security) Audit & Hardening: We provide enterprise-grade security training and configuration for core Web3 team members. We assist teams in deploying security hardware and risk detection software to increase the difficulty of social engineering attacks, while auditing password management protocols and device security policies.
  2. End-to-End Incident Response (IR): In an emergency, every second of confusion amplifies the loss. AUTOSEC.DEV provides standardized SOPs (Standard Operating Procedures) and rapid response services tailored to specific business needs to help projects mitigate losses quickly.

Service Content​

Reference​

https://x.com/CertiKAlert/status/2043557571609731268