Hackers Minted 1 Billion Fake DOT on Ethereum, CertiK Says
CertiK says hackers minted 1 billion fake DOT tokens on Ethereum mainnet and sold them off. Here is what happened, why it matters, and the key risks for traders.
Hackers appear to have minted one billion fake DOT tokens on Ethereum mainnet and dumped them through DEX liquidity, turning what looked like a Polkadot headline into a bridge-asset security incident tied to Ethereum-side infrastructure rather than native DOT issuance.
Key Points
- Etherscan records the exploit transaction on Ethereum mainnet and shows the mint, routing path, and proceeds on one page.
- Etherscan’s token page identifies the affected ERC-20 as Hyperbridge-linked DOT and carries an exploit warning.
- Available reporting indicates the incident hit bridged DOT on Ethereum, not native DOT on the Polkadot relay chain.
What Happened in the Fake DOT Mint on Ethereum
Etherscan records transaction 0x240aeb9a8b2aabf64ed8e1e480d3e7be140cf530dc1e5606cb16671029401109 as successful on April 13, 2026 at 03:55:23 UTC, which is the clearest primary-source anchor for the incident. That matters because it establishes the event on Ethereum mainnet rather than on Polkadot’s native issuance layer.
On-Chain Snapshot
1,000,000,000 DOT
Minted from the null address and routed toward Uniswap V4 liquidity on Ethereum.
108.206143512481490001 ETH ($237,791.82) ended up back at the address labeled Bridged DOT Exploiter.
Source: Etherscan transaction view and internal transfers
The same Etherscan entry shows the tokens being minted from the null address, routed through newly created addresses, and pushed into Uniswap V4: Pool Manager before value flowed back to the exploiter-labeled wallet. That sequence ties the unauthorized mint, the sell-off path, and the realized proceeds to one explorer record rather than to rumor or screenshot-based reporting.
Concise Timeline
- The exploit transaction landed on Ethereum mainnet at April 13, 2026 at 03:55:23 UTC.
- The same transaction page shows the counterfeit DOT minted from the null address and moved into Uniswap V4: Pool Manager.
- Internal transfers on that transaction show the ETH proceeds ending at the address labeled Bridged DOT Exploiter.
A single BeInCrypto report said CertiK attributed the breach to a forged message that manipulated the token contract’s admin role on Ethereum, but that root-cause theory remains unconfirmed in this source set because no direct CertiK post was fetched. The narrower claim is the safer one: the explorer evidence confirms the mint-and-dump path, while the exact exploit mechanism still needs primary confirmation.
BeInCrypto also reported that the incident targeted bridged DOT on Ethereum rather than native DOT on Polkadot itself. That distinction is immediately important to traders because ticker recognition alone does not tell them which chain, contract, or redemption model they are actually buying.
Why the Fake DOT Mint Matters for Security and Market Trust
Etherscan’s token page lists the affected ERC-20 as “Polkadot Token (Relay Chain) (DOT),” links it to Hyperbridge, and warns that the token has been exploited. For traders, that is the first practical lesson: the ticker may say DOT, but the contract risk sits inside a specific Ethereum wrapper.
Hyperbridge’s Token Gateway page says the bridge is “fully trust-free,” uses proofs to authorize burning and minting, and maintains a 1:1 redemption model backed by a ledger so malicious chains cannot withdraw more than they deposit. The contrast between those stated controls and the observed mint-from-null path on Ethereum is what makes this a wrapped-asset security story rather than a question about Polkadot’s monetary policy.
How Incidents Like This Damage Confidence Across Altcoin Markets
When an explorer warning sits beside a token that still carries the DOT ticker, every wrapper, bridge route, and liquidity pool attached to that ticker becomes harder to trust. That trust premium already matters in adjacent infrastructure stories such as Chainalysis Says Stablecoin Volume Could Hit $719T by 2035, where tokenized assets only scale if counterparties believe redemption and contract controls work as advertised.
The same principle shows up in crypto credit markets. Coverage like Morpho Borrowers Paid $170M in Interest Over the Past Year: Token Terminal illustrates how quickly a token can move from spot speculation into borrowing and collateral, which turns contract authenticity into a balance-sheet issue rather than a cosmetic branding issue.
Before trading any wrapped or bridged asset, readers should verify the contract page, check for exploit banners or unusual admin-role changes, confirm the issuing bridge documentation, and inspect where liquidity is actually routed. Those checks matter for synthetic assets and new listings alike, which is part of the broader quality problem explored in token launch failures on the EthCC agenda for 2026.
Outlook
The most defensible conclusion from the current evidence is narrower than the headline shock: Ethereum-side bridged DOT liquidity was compromised, while native Polkadot issuance was not shown to be affected. Until Hyperbridge, Polytope Labs, or the Polkadot team publishes a direct incident statement, detailed claims about the exact exploit mechanics should be treated as provisional and secondary to the explorer record.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
