ASTRBUSD
ASTR / Binance USD
crypto

You saw the 1 billion DOT minted today. One forged proof, unlimited minting through Hyperbridge's shared TokenGateway. DOT was just the most liquid target. Here are ALL the tokens on the same gateway:
- BNC (Bifrost)
- vDOT, vBNC (Bifrost liquid staking)
- ASTR (Astar)
- vASTR (Bifrost liquid staking Astar)
- GLMR (Moonbeam)
- vGLMR (Bifrost liquid staking Moonbeam)
- MANTA, CERE, VFY (zkVerify)
An earlier attack reportedly already drained ~$12K in MANTA and CERE using the same vector.
All of these use the same HyperFungibleToken standard with a single onlyGateway modifier. Whoever controls the gateway controls minting for every token in the list.
The root cause: a Merkle Mountain Range proof replay vulnerability. The contract checks that a request hasn't been used before but never checks that the proof actually corresponds to that request. Old valid proof + new malicious request = accepted. The attacker used this to change admin privileges on the DOT contract because it had a Uniswap pool to dump into.
Hyperbridge connects 14+ networks including Ethereum, Arbitrum, Base, Optimism, Polygon, BSC, and Tron. Until the proof-to-request binding is fixed - check your exposure if you hold anything listed above.
Source: https://x.com/zacodil/status/2043585648037183498

You saw the 1 billion DOT minted today. One forged proof, unlimited minting through Hyperbridge's shared TokenGateway. DOT was just the most liquid target. Here are ALL the tokens on the same gateway:
- BNC (Bifrost)
- vDOT, vBNC (Bifrost liquid staking)
- ASTR (Astar)
- vASTR (Bifrost liquid staking Astar)
- GLMR (Moonbeam)
- vGLMR (Bifrost liquid staking Moonbeam)
- MANTA, CERE, VFY (zkVerify)
An earlier attack reportedly already drained ~$12K in MANTA and CERE using the same vector.
All of these use the same HyperFungibleToken standard with a single onlyGateway modifier. Whoever controls the gateway controls minting for every token in the list.
The root cause: a Merkle Mountain Range proof replay vulnerability. The contract checks that a request hasn't been used before but never checks that the proof actually corresponds to that request. Old valid proof + new malicious request = accepted. The attacker used this to change admin privileges on the DOT contract because it had a Uniswap pool to dump into.
Hyperbridge connects 14+ networks including Ethereum, Arbitrum, Base, Optimism, Polygon, BSC, and Tron. Until the proof-to-request binding is fixed - check your exposure if you hold anything listed above.
Source: https://x.com/zacodil/status/2043585648037183498