Hyperbridge increases losses to US$2,5 million after failure.

• Hyperbridge exploitation generates millions in cryptocurrency losses.
• Cross-chain flaw creates fake DOTs on Ethereum.
• Blockchain security in focus after multi-network attack.

Hyperbridge has significantly revised the impact of a exploration The incident, which occurred on April 13, raised the estimated losses to approximately US$2,5 million. Initially, the project had reported losses close to US$237, but a more in-depth analysis revealed much greater damage involving different blockchain networks.

According to the team, the new estimate considered the attacker's activity across four distinct blockchains. The attack followed a two-stage structure, which made it difficult to fully identify the losses early on, especially considering the inclusion of incentives associated with the compromised funds.

In the first phase, the attacker reportedly withdrew approximately 245 ETH from the Token Gateway system. Subsequently, the exploit progressed to a more complex stage, in which approximately 1 billion brokered DOT tokens were created without authorization and dumped into the market, affecting liquidity on decentralized exchanges.

The exploited flaw was linked to the MMR (Merkle Mountain Range) proof verification logic used by the HandlerV1 module. This vulnerability allowed the creation of fake messages in the cross-chain environment, giving the attacker access to administrative functions of the bridged token contract and enabling the mass issuance of fake DOTs on the Ethereum network.

The incident exclusively affected the Token Gateway and bridged token contracts on the Ethereum, Base, BNB Chain, and Arbitrum networks. Hyperbridge highlighted that the Polkadot network's native DOT was not impacted, nor were other ecosystem products linked to the Intent Gateway.

Part of the diverted funds has been traced back to Binance, and the team reported that it is collaborating with the exchange and authorities to try to freeze and recover the funds. If it is not possible to fully compensate users, the project is considering using BRIDGE tokens to cover any remaining losses.

Meanwhile, all Token Gateway connections remain suspended. Resumption of operations depends on the complete correction of the vulnerability, the completion of an independent audit, and the implementation of new security measures.