Polkadot Post-Mortem on XCM Vulnerability Incident: Treasury Loss of Approximately $1.381 Million

Polkadot’s Asset Hub suffered an XCM executor exploit from October 24–26 that reduced dotUSD’s recorded issuance without changing account balances, distorting pricing in the DOT/dotUSD liquidity pool and costing the treasury about $1.381 million in DOT as the pool’s sole liquidity provider; user funds were unaffected. A postmortem published November 2 said the bug was reported through a bounty program in June and fixed in the codebase, but the fix did not reach the affected production release. After an on-chain upgrade applied the fix on October 26, the team rescued the pool’s remaining liquidity, and an October 30 upgrade corrected dotUSD’s recorded issuance. The incident matters because it shows how a codebase fix can fail to reach production and leave protocol-owned liquidity exposed even when user balances are untouched. What to watch next is whether Polkadot tightens release and deployment checks so patched code is verified in live runtimes, and whether the treasury seeks recovery or rethinks its role as sole liquidity provider in the DOT/dotUSD pool.