Polkadot XCM bug erased 4.06M dotUSD from recorded supply, Treasury down $1.3M

Serguey Asael Shinder28 October 2026, 09:191 min read

An XCM bug on Polkadot Asset Hub caused about 4.06 million dotUSD to be removed from the token's recorded supply while the tokens themselves stayed in the DOT/dotUSD liquidity pool, according to a forum update posted on 26 October by the forum user bkchr. The mismatch created a pricing imbalance in the pool, which arbitrage traders exploited, cutting the Polkadot Treasury's liquidity position by an estimated $1.3 million.

The Polkadot Technical Fellowship found the issue over the weekend and fixed it through a whitelisted caller referendum, the fast track reserved for urgent technical changes. The underlying bug was fixed and the affected assets were moved to a controlled account to prevent further extraction. The update says user wallets and funds were not affected and no action is required.

On 27 October a follow-up said Referendum 1961 had been submitted with two changes: restore dotUSD's recorded supply to match existing balances without changing any individual holding, and restore Snowbridge by reverting inaccurate execution weights introduced in the latest Bridge Hub runtime upgrade. A full technical post-mortem has been promised.

What it means

The loss came from accounting, not theft of keys: supply and balances disagreed, and the market priced the disagreement within hours. That is the usual shape of cross-chain messaging bugs — an amount is subtracted in one ledger and not in another. The second item in Referendum 1961 is worth reading too: a runtime upgrade with wrong weights quietly broke the bridge, which suggests the post-mortem will be about upgrade testing as much as XCM.