How the Polkadot Bridge Exploit Happened (Beginners explanation).

An attacker exploited a vulnerability in a bridge between Polkadot and Ethereum, allowing them to mint a huge amount of unbacked tokens and sell them on the market.
Despite the massive supply created, they were only able to extract around $240,000 in ETH before liquidity ran out.
Let’s break down how this was possible step by step.
What Is a Blockchain Bridge?
To understand what happened, we need to start from the basics.
Blockchains like Polkadot and Ethereum are separate systems, they don’t naturally communicate with each other. A bridge is a tool that connects them.
Simple analogy:
Imagine two countries with different currencies:
Country A = Polkadot
Country B = Ethereum
A bridge works like a currency exchange office:
You deposit real DOT on Polkadot, the bridge locks it and it. gives you “wrapped DOT” on Ethereum.
This wrapped token represents your real DOT.
That wrapped token only has value if the bridge is secure and trustworthy.
What Are Cryptographic Proofs?
Bridges don’t trust users directly. Instead, they rely on cryptographic proofs.
A cryptographic proof is like a mathematically verifiable receipt that says:
“This event really happened on the other blockchain.”
Example:
“User locked 100 DOT on Polkadot”
The proof confirms this is true, the bridge then issues 100 wrapped DOT on Ethereum.
Why is this secure?
Because these proofs are based on complex math and blockchain data, they are designed to be impossible to fake.
What Does “Forge” Mean?
To forge something in crypto means to create a fake version that looks real enough to fool the system.
Making the system believe something happened when it didn’t.
This is exactly where things went wrong.
The core problem in this case was that the bridge trusted a fake proof.,
Instead of properly verifying: “Is this proof real?”
The system effectively said: “Looks good to me.”
But in reality, it wasn’t.
How the Attacker Took Control
The attacker didn’t just fake a transaction, they used the forged proof to trigger a privileged action inside the smart contract.
A smart contract is a program on the blockchain that automatically executes rules and controls assets.
Some functions are restricted to admins only.
What happened here?
The attacker submitted a forged proof, and the contract believed it came from a trusted source. As a result, it allowed the execution of a restricted function, which gave the attacker admin privileges. At that point, they had full control over the contract.
The Attack:
With full control now the attacker minted 1,000,000,000 fake wrapped DOT tokens on Ethereum. These tokens were not backed by real DOT
To convert them into real money, they used liquidity pools on Uniswap.
They swapped the fake tokens for ETH using pools where real users had deposited funds.
Important clarification: This was not a failure of Uniswap. Uniswap is permissionless and does not verify whether a token is “legitimate” or if a token exists and has liquidity. The trades are executed automatically.
The real issue was the vulnerable bridge (Hyperbridge), which allowed invalid, unbacked tokens to exist in the first place.
Where the Attack Actually Happened:
The attacker never touched the core Polkadot network.
Everything happened across:
Ethereum → where fake tokens were minted and sold
Uniswap → where liquidity was drained
The bridge → where the vulnerability existed
The Final Result:
the attacker extracted about 108 ETH (~$240K) before liquidity was exhausted.