Hyperbridge: They Said It Could Not Be Hacked. It Got Hacked.

On 1 April 2026, Hyperbridge announced that it had been hacked.

The post said North Korea's Lazarus Group had drained $37 million from its deployments on Ethereum, Arbitrum and Base. It blamed rogue AI agents and quantum computers, and joked that the auditors had tried to warn the team but nobody was around because the developers were out eating KitKat bars to celebrate an engineer becoming a father. A link led to a blog post that opened with a Rickroll and was titled "Why Hyperbridge Can't Be Hacked". None of it was true. It was an April Fools joke, and when members of the community called it tasteless, the project answered that its core community knew the protocol was "un-hackable".

Twelve days later, on 13 April, it was hacked for real.

What Hyperbridge is

Hyperbridge is a bridge, software that moves crypto between blockchains that cannot otherwise talk to each other, rather like a transfer service between two banks on incompatible systems. It was built by Polytope Labs, a company founded in 2023 by Seun Lanlege, a former engineer at Parity Technologies, the main developer of the Polkadot blockchain, and David Salami. Its seed round in 2024 was led by the Polkadot Ecosystem Fund, a venture backed by the Web3 Foundation, and it became the main route for moving DOT, Polkadot's own coin, onto Ethereum and other networks.

Bridges are where much of crypto's money gets stolen. Ronin Bridge lost $625 million in 2022; Wormhole lost $320 million the same year. Most of those bridges relied on a small group of trusted operators to approve transfers, and the attackers went after the operators. Hyperbridge's pitch was that it needed no trusted middlemen. Every message crossing the bridge came with a cryptographic proof, a piece of maths showing that the transfer really happened on the other chain, and the receiving side checked that proof itself. It is the equivalent of a cheque that cannot be cashed unless the paying bank's own ledger confirms it.

The pitch was sound. The code checking the maths was not.

How the proof was faked

The proofs Hyperbridge used are built on a structure called a Merkle Mountain Range, a compact way of showing that one record belongs to a long list without sending the whole list. To check a proof, the code is told where in the list the record sits and how long the list is. The security firm Verichains found that the code never confirmed the position was actually inside the list. Told that a one-item list had a record at position two, the verification routine skipped its normal path and simply accepted a number the attacker supplied as the correct answer. The blockchain security firm BlockSec Phalcon described the same flaw as a proof that was never tied to the message it was meant to prove.

The fix, Verichains wrote, was a single line of code checking that the position was smaller than the list length.

With that gap, the attacker could send Hyperbridge's Ethereum contract any message and have it accepted as genuine. In the early hours of 13 April, UTC, they sent one that made themselves administrator of the bridged DOT token contract on Ethereum, the version of DOT that exists on Ethereum and is meant to be backed one-for-one by real DOT locked on Polkadot. As administrator they could create tokens at will. They minted 1 billion bridged DOT, worth about $1.19 billion on paper at the market price of real DOT.

A billion dollars that could not be sold

Paper value is not money. To turn the fake DOT into something real, the attacker had to sell it, using Uniswap and the trading router Odos, into liquidity pools: pots of tokens deposited by users that fill trades automatically, like a market maker with a fixed float. The pots for bridged DOT were small. The price of bridged DOT on Ethereum collapsed from about $1.22 to a fraction of a cent within moments, and the main sell-off returned 108.2 ether, about $237,000. That was the figure first reported by the security firm CertiK and repeated widely.

It was not the whole loss. About an hour before the mint, according to the on-chain analyst Specter, the attacker had drained roughly 245 ether, worth more than $500,000, from Hyperbridge's Token Gateway contract, and split it across 15 wallets before sending it through Tornado Cash, a mixing service that hides where coins came from. On 16 April Hyperbridge revised its estimate to about $2.5 million, more than ten times the first number, after counting drained reward pools for DOT on Ethereum, Base, BNB Chain and Arbitrum.

Parity Technologies said the damage was limited to Hyperbridge's Ethereum gateway: the Polkadot network itself and native DOT were untouched. DOT still fell about 5 per cent, to $1.14, close to its all-time low. The April Fools posts were deleted.

The warnings before it

The joke was not the only red flag. Protos, the crypto news site, reported that screenshots posted on X in February appeared to show a bug bounty hunter, a researcher paid to report security holes, flagging critical vulnerabilities to the team and being told to "exploit them if you found them". After the April Fools post, a known exploiter address began testing the bridge's contracts. The attempts were dismissed on X with the line "hope you have a quantum computer bro", Protos reported. Hyperbridge has not publicly addressed the February screenshots.

The rebuild and the bill

In a post on 16 April signed by Lanlege, Hyperbridge said a significant portion of the stolen funds had been traced to Binance, the world's largest crypto exchange, and that it was working with Binance's compliance team and law enforcement agencies it did not name. It warned that recovery could take up to a year. If users were not made whole by then, it promised to cover the remaining losses with its own BRIDGE tokens, with the schedule and valuation to be published on 13 April 2027.

It also promised the Token Gateway would stay shut until the bug was fixed, independently audited and backed by new safeguards. It went further. On 15 June 2026 Hyperbridge reopened after rebuilding rather than patching: the shared Token Gateway was retired, each bridged token was given its own contract, the system's administrative keys were removed, and anyone can now generate the proofs, a job one team used to control. The security firm SRLabs audited the new design, and Hyperbridge said it paid more than $150,000 through the bounty platform HackenProof to over 20 researchers in under a week.

No arrest has been reported, no stolen funds have been publicly returned, and the date for the token compensation plan is still six months away.