PolkaStats

Polkastats block explorer dev

[Wei Tang @sorpaas]

JAR Chain is a community fork of #Polkadot JAM.

* We're actually going to launch this year. Not delays, delays, delays.
* Our JAVM is around 2x faster than JAM PolkaVM.
* Actually secure: we re-designed the execution engine from ground up with a new capability system and KVM microkernel.

Interested? Join our discussions on Matrix. https://t.co/cHMWfPrhAd

[Hyperbridge @hyperbridge]

On April 13, 2026, an attacker exploited a vulnerability in Hyperbridge’s MMR verifier and drained the Token Gateway.

After a round of internal audits, we found the same class of bug in two widely used libraries across the Polkadot ecosystem, including pallet-beefy-mmr.

Here’s the full account 🧵

[Wei Tang @sorpaas]

JAM/ELVES has one critical soundness issue that makes it susceptible to LayerZero-type degradation.

Safety bound is magnitude lower than claimed.

In the past, it's practically unlikely that validators mass run modified node versions.

Nowadays, agentic development means that a rational validator will be able to do it if the incentive is not aligned.

We cannot any more make a blanket categorization of adversarial / non-adversarial nodes. The actual incentives and the reality of a "rational node implementation" must be explicitly quantified.

[Verso @verso0x]

If you just woke up and saw $DOT @Polkadot hacked, here is what I found (long-read)
THE SETUP

Hyperbridge uses ISMP (Interoperability State Machine Protocol) to bridge Polkadot assets to Ethereum. The architecture:

- EthereumHost - stores consensus state & commitments
- HandlerV1 - verifies proofs, dispatches messages
- Consensus Client - verifies BEEFY/GRANDPA proofs from Polkadot
- TokenGateway - mints/burns wrapped assets (DOT, ARGN, MANTA, etc.)

Two critical facts about the live config:
1) challengePeriod = 0 (no delay before state commitments become usable)
2) The consensus client (0xA0Ad0CfD02509321AA5968cD04A8E205Ce53669a) is UNVERIFIED - no public source code

---

THE ATTACK (one atomic transaction)

TX: https://t.co/7rUn3Lsz71

Attacker 0xC513E4f5D7a93A1Dd5B7C4D9f6cC2F52d2F1F8E7 deployed an exploit contract whose constructor executed this entire sequence:

1. Deploy sub-contract (0x31a165a956842aB783098641dB25C7a9067ca9AB)
2. Call run() on sub-contract
3. Sub-contract calls HandlerV1.handleConsensus() with a FORGED Polkadot consensus proof
4. The unverified consensus client accepts the forged proof
5. A malicious state commitment (containing attacker-controlled MMR root) gets stored in EthereumHost
6. Since challengePeriod = 0, the commitment is IMMEDIATELY usable, no fisherman dispute window
7. Sub-contract calls HandlerV1.handlePostRequests() with a crafted MMR proof referencing the just-stored malicious root
8. The MMR verification passes trivially, attacker controls BOTH the root and the proof
9. The forged ISMP message contains: action=ChangeAssetAdmin, source="POLKADOT-3367", newAdmin=sub-contract
10. TokenGateway checks request.source == "POLKADOT-3367" - PASSES (source was embedded in forged MMR leaf)
11. TokenGateway calls DOT.changeAdmin(sub-contract), sub-contract is now DOT admin
12. Sub-contract calls https://t.co/ek9hZaR6zQ(1,000,000,000 DOT)
13. Sub-contract approves DEX router for max, swaps 1B DOT for 108.2 ETH via Uniswap V4
14. ETH flows back: sub-contract -> exploit contract -> attacker EOA

All in one transaction. Gas cost: 0.000339 ETH. Profit: 108.2 ETH.

---

WHY THE SOURCE CHECK FAILS

TokenGateway's authorization for privileged actions like ChangeAssetAdmin:

if (!request.source.equals(host.hyperbridge())) revert UnauthorizedAction();

This byte comparison is not a security boundary. It relies entirely on the integrity of the consensus proof upstream. The source field lives inside the MMR leaf, when the attacker controls the MMR root, they control every leaf, including the source field. The check becomes a tautology.

---

ROOT CAUSE

Two combined weaknesses:

challengePeriod = 0: The challenge period is the only defense against forged consensus proofs. When it's zero, any fraudulent state commitment accepted by the consensus client is immediately exploitable in the same block. No fisherman window. No dispute mechanism. Plant and exploit in one tx.

Unverified consensus client: The contract at 0xA0Ad0CfD02509321AA5968cD04A8E205Ce53669a has no public source code. Its verifyConsensus() accepted a forged BEEFY proof. Either a cryptographic bug, a deliberately weakened replacement, or a compromised signing key.

---

SCOPE: NOT JUST DOT

The attacker exploited multiple Hyperbridge-wrapped assets via the same vector:
- DOT: 1B minted (~$1.78B face value)
- ARGN (Argon): ~999B minted (~$1.03B face)
- MANTA: 211K minted (partially captured by MEV bot)
- CERE: ~23B minted (partially captured by MEV bot)

All ERC6160Ext20 tokens managed by the same TokenGateway. Same forged ISMP message, different action payloads.

---

ATTACKER PROFILE

- 33-day-old wallet, seeded from a RAILGUN RelayAdapt contract (not a simple EOA)
- Spent a month deploying 15+ test contracts against live state
- Used https://t.co/cEhae8a7y3 to bridge ETH across chains immediately after funding (obfuscation)
- Pre-deployed custom zk-SNARK verification keys via RAILGUN 8.5 months before the exploit
- Laundering confirmed via RAILGUN zk shielded pool, withdrawing in 15 ETH denominations to fresh exit wallets

Months of preparation.

---

FUND FLOW

Primary swap: ~108.2 ETH ($237k)
Secondary waves: ~4,924 ETH ($10.8k)
Later stablecoin: ~$8k (WETH/USDC/USDT)
Total extracted: ~$250kM+

EthereumHost is frozen (status=All). Attacker is laundering through RAILGUN. No bridge-out transactions observed yet. Exit wallet 0x43C291c59164e55E27326a719c4FD05a1b72F8b2 holds ~105 ETH from RAILGUN withdrawals.

---

KEY ADDRESSES

Attacker: https://t.co/EAkYS1xp5I
DOT Token: https://t.co/hKxJ8GaDPG
TokenGateway: https://t.co/B1UWfsYq0u
EthereumHost: https://t.co/gdJNH5cIl7
Consensus Client (unverified): https://t.co/7UEVaBNUqv
RAILGUN Exit Wallet: https://t.co/U3NXOiUctF

[PolkaStats @PolkaStats]

@peaq Hey @peaq, did you found the root cause of the halting?

[PolkaStats @PolkaStats]

Block production on @peaqnetwork parachain has halted. Check https://t.co/gQGY85k5Eu

[Josep @Joseptec]

Grateful to all the unsung heroes who’ve helped the PAPI team through these very difficult times. Now that we’re starting to see the light at the end of the tunnel, it’s been humbling to see how many people stepped up and had our backs. Thank you so much! 🙇‍♂️

[PolkaStats @PolkaStats]

Strongly supporting @Polkadot Ref 1836 to continue funding PAPI team! 📷PAPI is the library we need: metadata-driven, strictly type-safe, and built for decentralization with native Smoldot light client support. https://t.co/TE4xKGQH4F

[PolkaStats @PolkaStats]

🚨 URGENT: 188,932 DOT at risk after sophisticated social engineering. Funds are currently bonded but a governance recovery (Root) is required to prevent theft.
[1] Read the full story and join the discussion:
🔗 https://t.co/An8tpOsRqP
#Polkadot #OpenGov

[Hyperbridge @hyperbridge]

The next era of interoperability has begun.

You can now bridge & swap your USDC and USDT seamlessly across EVM networks, powered by Hyperbridge.

But it doesn’t end there, there’s always more…

[Avalanche🔺 @avax]

America’s first state-issued stablecoin is here.

FRNT, formerly known as WYST, is now live on Avalanche and will soon be spendable through @raincards' Visa-integrated platform.

Programmable money is becoming real-world money. Here’s why it matters 🧵

[Heima @heimaNetwork]

Meet @wildmetaHQ 🦦🚀
We’re building Wildmeta — a mobile-first @HyperliquidX super app at Heima, powered by our own chain abstraction tech.

💡Want to be part of it early? Join the waitlist 👉https://t.co/3PW3mRTTSq

Trade perps, connect with pro traders, and track it all from your pocket — all on-chain and cross-chain.

#Wildmeta #Heima #Hyperliquid

[Alice und Bob @alice_und_bob]

🗺️ July 2025 Polkadot Roadmap 🗺️

New:
- NOMT -> 10x Performance, landing in 2026?

Releasing soon:
- Polkadot 2.0 - Elastic Scaling (August?)
- Polkadot Hub - developer and user onboarding platform (October?)
- Polkadot Pay - mobile app (August?)

Catalysts:
- Polkadot 2.0 Launch Party (September?)
- DOT ETFs (decision November)
- DOT Tokenomics 2.0
- Spammening

[PolkaStats @PolkaStats]

A huge thank you to our team, @DragonStake and @ssv_network for helping bring this vision to life. Stay tuned – more updates are coming soon!

[PolkaStats @PolkaStats]

Excited to announce the launch of our brand-new frontend for SSVScan – the explorer/indexer for the SSV network! check it out! https://t.co/kfgoJPhktT 🚀🔍

[PolkaStats @PolkaStats]

Visit https://t.co/kfgoJPhktT now and explore the new frontend! We’d love to hear your feedback as we continue to innovate. #SSVNetwork #SSVScan #FrontendDev #Web3

[PolkaStats @PolkaStats]

Whether you’re a validator, operator, or a curious user, the new SSVScan experience puts the power of SSV network data right at your fingertips

[PolkaStats @PolkaStats]

Key improvements include: • Responsive design for seamless browsing on any device
• New operator charts & visualizations for detailed performance insights
• Faster load times & smoother navigation

[PolkaStats @PolkaStats]

We’ve completely revamped the interface with a clean, modern design that makes it easier than ever to dive deep into SSV network insights in real time

[ᑕᗩ₱₱ΞX @CryptoCappex]

Phala Network has reached a record market cap of about $350 million significantly surpassing the previous ATH, unlike the previous cycle, however, this time the technology for AI Agents is ready! 🔥

When do you think $PHA will be able to surpass the previous ATH of 1.39 usd? 👀