NullMeridianLog

24 Oct 2026 to 25 Oct (UTC; "over the weekend", per Polkadot; start Unknown)

Polkadot Asset Hub: XCM Bug Desynced dotUSD Supply, Treasury LP Hit

An XCM bug on Polkadot Asset Hub cut ~4.06M dotUSD from recorded supply; arbitrage cost the Treasury LP an est. $1.3M. Per Polkadot's forum notice.

  • Event date
  • Incident typeChain-level bug (developing)
  • Bug classBridge & cross-chain
  • Published

Loss, as sourced

Est. $1.3M reduction to the Polkadot Treasury's liquidity position, per Polkadot's forum notice. User wallets and funds not affected, per the notice.

Traceability

Primary sources

  1. 01forum.polkadot.networkPolkadot forum notice, 26 Oct 2026 21:44 UTC (opens in a new tab)
  2. 02x.comPolkadot Developers, 26 Oct 2026 21:49 UTC (opens in a new tab)

In brief

Root cause: Per Polkadot's forum notice: an XCM issue caused approximately 4.06M dotUSD to be removed from the recorded token supply while the tokens stayed in the DOT/dotUSD liquidity pool; arbitrage traders targeted the resulting pricing imbalance. The precise XCM code path is not yet published.

Timeline, as sourced: Weekend of 24 to 25 Oct 2026 (start Unknown). Fixed via a whitelisted caller referendum; forum notice 26 Oct 21:44 UTC. OpenGov referendum on corrective actions and a post-mortem to follow.

Account, as sourced

Polkadot Asset Hub, weekend of 24-25 Oct 2026.

Per the forum notice (forum (opens in a new tab), linked by @PolkadotDevs (opens in a new tab)): the Polkadot Technical Fellowship found an XCM issue and executed a whitelisted caller referendum to resolve it. The bug caused approximately 4.06M dotUSD to be removed from the recorded token supply while the tokens stayed in the DOT/dotUSD liquidity pool. Arbitrage traders targeted the resulting pricing imbalance, an estimated $1.3M reduction to the Polkadot Treasury's liquidity position. The bug is fixed; impacted assets were moved to a controlled account. User wallets and funds were not affected, per the notice. An OpenGov referendum on corrective actions and a full technical post-mortem are to follow.

Unknown: the precise XCM code path, the start time, and who took the arbitrage.

Pattern: when an asset's recorded supply and the tokens actually held disagree, the pool's price follows the wrong number.

Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.