# Independent On-Chain Investigation: Hyperbridge Token Gateway Exploit (Updated April 17) **URL:** \ **Category:** Ecosystem\ **Created:** [April 17, 2026, 2:44am UTC](https://forum.polkadot.network/t/independent-on-chain-investigation-hyperbridge-token-gateway-exploit-updated-april-17/17557 "2026-04-17T02:44:53Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Abdulbee](https://dub1.discourse-cdn.com/flex005/user_avatar/forum.polkadot.network/abdulbee/32/11105_2.png) [@Abdulbee](https://forum.polkadot.network/u/Abdulbee)\ **Post date:** [April 17, 2026, 2:44am UTC](https://forum.polkadot.network/t/independent-on-chain-investigation-hyperbridge-token-gateway-exploit-updated-april-17/17557/1 "2026-04-17T02:44:53Z")
**Update (April 17):** This investigation has expanded. The original post covered one attacker cluster. Continued analysis has identified a second, independent attacker who struck the same Token Gateway contract 53 minutes earlier using a different extraction method and a more sophisticated laundering structure. The combined confirmed attacker-side extraction is now $845,000 across two investigated clusters. A third, smaller attack ($12K in MANTA/CERE) has been reported by other sources but has not yet been independently verified. The full scope of this exploit is likely broader than any single attacker cluster. We are still digging. Both full reports are published on [hubsec.net](https://hubsec.net/research). * * * Following the April 13 exploit of Hyperbridge’s Token Gateway on Ethereum, I conducted an independent on-chain investigation to understand what was actually extracted and where the funds went. The initial reporting put losses at $237K. Hyperbridge later revised the figure to approximately $2.5M. Both numbers are correct, but they measure different things. **This was not a single-attacker incident.** At least two independent attackers exploited the same vulnerability on the same day, using different extraction methods, different laundering strategies, and different operational tradecraft. A third smaller attack has been reported. It is possible that additional attacker addresses were involved that have not yet been identified. **Attacker 1 (block 24,868,295):** Operated a three-address cluster. The primary EOA was funded through Railgun, was 37 days old, and deployed over 15 test contracts in the weeks before execution. In one atomic transaction, the attacker forged an MMR proof to bypass HandlerV1’s verification, hijacked admin privileges on the Bridged DOT (ERC-6160) token contract via TokenGateway, minted 1 billion DOT, and swapped them through Odos Router and Uniswap V4 for 108.2 ETH. Total gas cost was 0.000339 ETH. Fund tracing across six EVM chains shows this attacker sent $272,174 to Tornado Cash across nine direct transactions from the primary EOA. A live balance check confirms the cluster now holds $49. Empty. **Attacker 2 (block 24,868,029, 53 minutes earlier):** Used a 4-day-old wallet with only 2 transactions. Deployed two exploit contracts that siphoned 245.93 WETH ($573,000) directly from the Token Gateway’s Wrapped Ether holdings via the `onAccept()` path. No token minting was involved. The proceeds were split across 15 burner wallets in equal 16.39 ETH batches, all forwarded to Tornado Cash. Both exploit contracts self-destructed within the same transaction to erase their bytecode. This attacker was more operationally sophisticated: younger wallet, fewer transactions, self-destructing contracts, multi-wallet laundering fan-out, and struck first. **Combined confirmed extraction:** | Attacker | Method | Extracted | Sent to Tornado Cash | | --- | --- | --- | --- | | Attacker 1 | Minted 1B DOT, swapped for ETH | ~$272,000 | $272,174 | | Attacker 2 | Siphoned 245.93 WETH directly | ~$573,000 | $572,790 | | Earlier test hack (not yet investigated) | MANTA/CERE drain via onAccept() | ~$12,000 | Unknown | | **Combined** | | **~$857,000** | **$844,964** | **Reconciling with Hyperbridge’s $2.5M figure:** The combined attacker-side extraction from both investigations accounts for approximately $845,000. Hyperbridge’s April 15 update reported approximately $2.5M, described as “losses from incentive pools across Ethereum, Base, BNB Chain, and Arbitrum.” The remaining $1.65M could reflect additional exploitation paths not yet identified, the reported $12K MANTA/CERE attack, incentive pool replacement costs on the victim side, or a combination of all three. This is an active investigation. Both attacker clusters are now empty. All confirmed proceeds have been sent to Tornado Cash. There is no hidden inventory in the wallets we have investigated. **Whether the two attackers are the same person is unknown.** Entity resolution found no common funding source, no shared burner wallets, and no temporal correlation in wallet creation between the two clusters. The on-chain evidence is consistent with two independent actors discovering the same vulnerability, but coordination through off-chain channels cannot be ruled out. **Additional finding:** Address 0x7ac0…cb19, which received 14.5M DOT across 27 bridge inbounds, was separately investigated and determined to be a legitimate exchange or market-maker wallet (909 hops, $0 net extraction, no cluster overlap with either attacker). The full reports with complete address references, fund flow diagrams, methodology, and limitations are published on [hubsec.net](https://hubsec.net/research): - [\* Attacker 1: DOT Minting Investigation](https://hubsec.net/research/hyperbridge-investigation-2026-04) - [\* Attacker 2: WETH Siphoning Investigation](https://hubsec.net/research/hyperbridge-investigation-2026-04-attacker-2) **Methodology:** All data was obtained through direct blockchain queries via Etherscan V2 API. The second investigation required internal transaction tracing to recover fund flows from self-destructed contracts, a technique that works because internal transaction records are stored in transaction receipts rather than contract state. No data was sourced from news articles, press releases, or third-party analysis. This is an ongoing investigation. If anyone has information about additional attacker addresses or exploitation paths related to this incident, the data would help complete the picture. ---
**Author:** ![christ](https://dub1.discourse-cdn.com/flex005/user_avatar/forum.polkadot.network/christ/32/2868_2.png) [@christ](https://forum.polkadot.network/u/christ)\ **Post date:** [April 17, 2026, 10:15am UTC](https://forum.polkadot.network/t/independent-on-chain-investigation-hyperbridge-token-gateway-exploit-updated-april-17/17557/2 "2026-04-17T10:15:48Z")
> The primary EOA was funded through Railgun, was 37 days old, and deployed over 15 test contracts in the weeks before execution. Thanks for the investigation. Were the test contracts copies or closely related to the Hyperbridge contracts or were they contracts setup to interact with the HyperBridge contracts? ---
**Author:** ![Abdulbee](https://dub1.discourse-cdn.com/flex005/user_avatar/forum.polkadot.network/abdulbee/32/11105_2.png) [@Abdulbee](https://forum.polkadot.network/u/Abdulbee)\ **Post date:** [April 17, 2026, 1:58pm UTC](https://forum.polkadot.network/t/independent-on-chain-investigation-hyperbridge-token-gateway-exploit-updated-april-17/17557/3 "2026-04-17T13:58:30Z")
> [@Abdulbee](#): > > Following the April 13 exploit of Hyperbridge’s Token Gateway on Ethereum, I conducted an independent on-chain investigation to understand what the attacker actually extracted and where the funds went. > > The initial reporting put losses at $237K. Hyperbridge later revised the figure to approximately $2.5M. Both numbers are correct, but they measure different things, and that distinction has not been clearly explained anywhere. > > **What the investigation found:** > > The attacker operated three addresses as a single cluster. The primary EOA was funded through _Railgun_, was 37 days old at the time of the exploit, and deployed over 15 test contracts in the weeks before execution. > > In one atomic transaction at block _24,868,295_, the attacker forged an MMR proof to bypass HandlerV1’s verification, hijacked admin privileges on the Bridged DOT (ERC-6160) token contract via TokenGateway, minted 1 billion DOT, and swapped them through Odos Router and Uniswap V4 for 108.2 ETH. Total gas cost was 0.000339 ETH. > > Fund tracing across six EVM chains (Ethereum, Arbitrum, Polygon, Base, BNB Chain, Optimism) shows the attacker sent $272,174 to Tornado Cash across nine transactions. A live balance check across all cluster addresses on all six chains confirms the cluster now holds $49. The attacker has no remaining inventory. > > **Reconciling the $237K, $272K, and $2.5M figures:** > > | Figure | What it measures | > | --- | --- | > | ~$237K (initial reports) | Approximate USD value of 108.2 ETH at time of exploit | > | ~$272K (this investigation) | Total value sent to Tornado Cash, measured at current spot | > | ~$2.5M (Hyperbridge April 15 update) | Protocol-side losses including incentive pool drains across Ethereum, Base, BNB Chain, and Arbitrum | > > The gap between $272K and $2.5M is not hiding in attacker wallets. The cluster is empty. The difference reflects what Hyperbridge needs to spend to restore incentive pool reserves and make affected users whole. These are different ledgers measuring different things. > > **Additional finding:** Address _0x7ac0…cb19_, which received 14.5M DOT across 27 bridge inbounds, was separately investigated and determined to be a legitimate exchange or market-maker wallet (909 hops, $0 net extraction, no cluster overlap with the attacker). > > The full report with complete address references, methodology, and limitations is published at [hubsec.net](https://hubsec.net/research/hyperbridge-investigation-2026-04). > > _ **Methodology:** All data was obtained through direct blockchain queries via Etherscan V2 API across six chains. No data was sourced from news articles, press releases, or third-party analysis. The methodology section of the full report documents the specific analysis methods, data sources, and known limitations._ They’re malicious contracts. the contract that drained WETH was actually set to self-destruct. So the component of that contract isn’t accessible. ---
**Author:** ![Abdulbee](https://dub1.discourse-cdn.com/flex005/user_avatar/forum.polkadot.network/abdulbee/32/11105_2.png) [@Abdulbee](https://forum.polkadot.network/u/Abdulbee)\ **Post date:** [April 17, 2026, 2:01pm UTC](https://forum.polkadot.network/t/independent-on-chain-investigation-hyperbridge-token-gateway-exploit-updated-april-17/17557/4 "2026-04-17T14:01:18Z")
They’re malicious contracts. the contract that drained WETH was actually set to self-destruct. So the component of that contract isn’t accessible. ---
**Author:** ![christ](https://dub1.discourse-cdn.com/flex005/user_avatar/forum.polkadot.network/christ/32/2868_2.png) [@christ](https://forum.polkadot.network/u/christ)\ **Post date:** [April 17, 2026, 3:24pm UTC](https://forum.polkadot.network/t/independent-on-chain-investigation-hyperbridge-token-gateway-exploit-updated-april-17/17557/5 "2026-04-17T15:24:49Z")
The number of contracts being created can’t be that large. Presumably these signals could be identified prior to attacks by monitoring the types of contracts being authored on-chain. ---
**Author:** ![HyperbridgeVictim](https://avatars.discourse-cdn.com/v4/letter/h/da6949/32.png) [@HyperbridgeVictim](https://forum.polkadot.network/u/HyperbridgeVictim)\ **Post date:** [April 17, 2026, 6:35pm UTC](https://forum.polkadot.network/t/independent-on-chain-investigation-hyperbridge-token-gateway-exploit-updated-april-17/17557/6 "2026-04-17T18:35:28Z")
Can anyone with on chain experience please tell us why no one mentions the ‚significant amount of hacked funds being sent to binance’ as stated by hyperbridge in their announcement? Is anyone able to find this trace ? This is the most important aspect for us victims and so far no information from hyperbridge ---
**Author:** ![Abdulbee](https://dub1.discourse-cdn.com/flex005/user_avatar/forum.polkadot.network/abdulbee/32/11105_2.png) [@Abdulbee](https://forum.polkadot.network/u/Abdulbee)\ **Post date:** [April 17, 2026, 7:10pm UTC](https://forum.polkadot.network/t/independent-on-chain-investigation-hyperbridge-token-gateway-exploit-updated-april-17/17557/7 "2026-04-17T19:10:23Z")
That would take quite some time to do, since the funds were funnelled via Tornado cash. I’ll post info as I dig more, and I’m sure Hyperbridge will too (I’m not affiliated with Hyperbridge by the way). ---
**Author:** ![Hackvictim](https://avatars.discourse-cdn.com/v4/letter/h/c57346/32.png) [@Hackvictim](https://forum.polkadot.network/u/Hackvictim)\ **Post date:** [April 22, 2026, 11:28pm UTC](https://forum.polkadot.network/t/independent-on-chain-investigation-hyperbridge-token-gateway-exploit-updated-april-17/17557/8 "2026-04-22T23:28:50Z")
> [@Abdulbee](#): > > The remaining $1.65M could reflect additional exploitation paths not yet identified, the reported $12K MANTA/CERE attack, incentive pool replacement costs on the victim side, or a combination of all three. This is an active investigation. Do you have any updated information on this? Affected users would really need to know how much funds safe or frozen or sitting on Binance. If 857.000 USD have been drained by hackers - the other 1.6 Million must be somewhere - they cant disappear. Can you pleae elaborate on that?