Polkadot XCM review: a June fix missed the release, an October exploit cost $1.38m

Victoria Shinder03 November 2026, 08:222 min read

Parity published a review on 2 November of the XCM incident on Polkadot Asset Hub between 24 and 26 October. An attacker used a bug in the XCM executor to lower the recorded issuance of dotUSD without touching any account balance. Because the Hub's exchange capped the dotUSD counted in the DOT/dotUSD pool at the lower of the pool's balance and the recorded supply, the understated supply distorted the pool's price and allowed trades at an artificial rate. The estimated loss was about $1.381 million in DOT. The Polkadot Treasury was the only liquidity provider in the pool, Parity says no users lost funds, and dotUSD stayed fully backed with 1:1 minting and redemption against USDT.

The more instructive part is the timeline. The bug, a WithdrawAsset path that reverted account debits on error but kept the change to total supply, was reported through Parity's bug bounty in June and fixed in pull request 11910. It was rated medium because dotUSD did not yet exist. The fix missed the stable-2606 release cut-off, never reached the affected production runtimes, and was only picked up in stable-2609. On 20 October the original reporter referred to the pull request in a public forum comment, which Parity says breached the programme's terms and may have given attackers enough context. Snowfork's halt of its relayers paused the attack on 24 October, a fix was proposed through OpenGov the same day, but on 26 October the attacker ran its own relayer about six hours before the upgrade was enacted.

Parity lists three areas of change: reassessing findings as new features change their impact, simplifying backports and verifying that fixes have actually reached deployed runtimes, and monitoring asset issuance for unusual changes. It has also started re-rating existing security reports in light of dotUSD.

What it means

The exploit was not the hard part; the process was. A known bug with a merged fix stayed live because severity was judged once and releases did not check what was actually deployed. For any chain shipping new assets on top of old code, the lesson Parity draws for itself applies widely: a severity rating is a claim about the system as it was, and it expires when the system changes.