XCM Incident Review: What Happened on Polkadot Asset Hub and What We Learned

I remember the morning the alerts started firing. My phone buzzed with a message from a parachain founder: "Something is off with dotUSD pricing on Asset Hub." I had been tracking the DOT/dotUSD pool for weeks, and the numbers simply did not add up — recorded supply was lower than the actual balances, and the pool was trading at a rate that made no sense. What followed, between October 24 and 26, 2026, was one of the most instructive security incidents in Polkadot's history: an XCM executor bug that let an attacker understate dotUSD's recorded issuance, distorting prices in the Hub's DEX pool and costing the Polkadot Treasury roughly $1.381 million in DOT value. No users lost funds. But the post-mortem, published on the Polkadot Forum on November 2, 2026, is a masterclass in how quickly assumptions can break — and why the boring parts of security (release pipelines, monitoring, severity reassessment) matter as much as the code itself.

Key Metrics at a Glance

What Happened: Breaking the Supply Invariant

XCM programs are supposed to be transactional: if a program fails, none of its state changes apply. The bug — present in certain error paths — violated that rule. An attacker crafted a program using the WithdrawAsset instruction that correctly reverted account debits on error but persisted the change to the recorded total supply. Repeating the sequence shrank the reported dotUSD issuance while account balances stayed unchanged.

That broke a core invariant: a single account's holdings should never exceed the asset's total supply. Asset Hub's DEX uses the minimum of the pool balance and the recorded supply to cap available dotUSD. Once reported supply fell below the pool's actual balance, pricing distorted, creating an arbitrage window to swap dotUSD for DOT at an artificial rate. The Polkadot Treasury was the only liquidity provider in that pool at the time, which is why it absorbed the ~$1.381 million loss. Critically, dotUSD remained fully backed the whole time, and the Peg Stability Module continued minting and redeeming at a fixed 1:1 ratio with USDT — so arbitrage was between the PSM and the pool, not a solvency failure.

Timeline: From June Bug Report to October Exploit

The uncomfortable part is how long the fix existed before it mattered. The vulnerability was reported to Parity through its Bug Bounty program in June 2026 and fixed in code via PR#11910. At the time it was classified medium severity — an assessment that did not account for dotUSD (not yet launched) or OpenGov implications. After the incident it was reclassified critical.

The fix missed the stable-2606 release cut-off and only landed in stable-2609 — and even then did not reach the affected production runtimes. On October 20, Parity saw a public forum comment referencing PR#11910, posted by the same researcher who had filed the bug bounty. That comment breached the program's disclosure terms (the reporter deleted it hours later), and Parity believes it may have given attackers enough context to find the vulnerability through other vectors.

On October 24, ecosystem partners alerted Parity to suspicious activity; within hours the team reproduced it. Snowfork halted its consensus relayers, delaying messages. Runtime 2.5.1, containing the XCM fix, was proposed via OpenGov that day. On October 26 the attacker briefly ran their own relayer and continued the attack for about six hours before the upgrade applied. With the fix on-chain, Parity rescued the remaining pool liquidity. Runtime 2.5.2, enacted October 30, corrected dotUSD's recorded supply from existing balances (without touching individual balances) and fixed a Snowbridge weight issue. The recovered dotUSD went back to the Treasury.

Competitive Context: How Polkadot's Response Compares

Polkadot's response stands out for three reasons: the loss was socialized to the Treasury rather than users, the PSM kept dotUSD redeemable at 1:1 throughout, and the post-mortem was published openly with technical detail. That is exactly the accountability posture a mature ecosystem should have.

What We Learned: Detection, Speed, Monitoring

Parity's own review names three focus areas. Detection: reassess security findings as systems evolve — a medium-severity bug became critical once dotUSD launched; they're adding agentic, automated analysis of pull requests and code to catch XCM failure scenarios earlier. Speed: simplify release and backport pipelines and verify that fixes actually reach deployed runtimes — a merged PR is not a shipped fix. Monitoring and response: watch for unusual changes in asset issuance earlier, tighten incident-response procedures, and re-review existing reports against new functionality. They also flagged the bug bounty disclosure breach and the growing risk of AI-assisted attacks.

A Framework for Evaluating XCM-Style Incidents

When the next cross-consensus bug surfaces, use this checklist: (1) Was the invariant broken at the protocol level (supply vs. balances) or only at the application level (pool pricing)? (2) Who bears the loss — treasury, users, or an insurer? (3) Did the asset remain fully backed and redeemable? (4) How fast did detection-to-containment take (hours matter)? (5) Did the project publish a technical post-mortem with concrete process changes? Polkadot scores well on 2, 3, and 5; the June-to-October gap is the cautionary tale on 1 and 4.

TL;DR

• What: An XCM executor bug on Polkadot Asset Hub (Oct 24–26, 2026) understated dotUSD's recorded issuance, distorting the DOT/dotUSD pool.
• Impact: ~$1.381M DOT loss absorbed by the Treasury (sole LP); no user funds lost; dotUSD stayed fully backed via the PSM at 1:1 with USDT.
• Root cause: A fix merged in June 2026 (PR#11910) missed production runtimes; severity was reclassified from medium to critical only after the incident.
• Fix: Runtime 2.5.1 (Oct 24) patched XCM; runtime 2.5.2 (Oct 30) corrected recorded supply; recovered dotUSD returned to the Treasury.
• Watch: Release-pipeline verification, issuance monitoring, severity reassessment as new features ship, and AI-assisted attack surfaces.

Sources

• Polkadot Forum: XCM Incident Review — What happened and what we learned (Nov 2, 2026)
• Polkadot Forum: XCM issue affecting Asset Hub (Oct 2026 incident thread)
• Parity Bug Bounty programme terms
• Parity PR#11910 (XCM transactional fix)
• Polkadot Wiki: XCM documentation
• Polkadot Wiki: Asset Hub

Gemma Nguyen is Content Lead & Journalist at Totestek, covering cryptocurrency, Web3, DeFi, and blockchain technology. She blends an independent journalistic voice with Totestek's editorial standards to explain complex on-chain events clearly.