Following the report about preferential funding that Bifrost had of 199k vDOT from the Singularity campaign funds not destined towards it, as part of the main effort to claim back available funds to Hyperbridge victims. Now we present the Polkadot side of the exploit which all reports up to now fail to detail.
This is the bulk of the exploit amount-wise and account for the missing ~1.29M DOT that was claimed missing and that was moved and placed mostly on the Polkadot chain. The exploit on Ethereum remained roughly 1/10 of the amount that moved on Polkadot.
So far, the EVM part of the exploit has been published and it corresponds to the initial amount reported, ~250k USD in value plus an additional that extends to fake token sale / Uniswap+Pancakeswap pool drain. Exploit tx:
0x240aeb9a8b2aabf64ed8e1e480d3e7be140cf530dc1e5606cb16671029401109
Now we will focus on the account where the DOT allocated to Hyperbridge sat was in the protocol's sovereign account on Asset Hub: This is the same one that was later used as the return address.
13cKp88n27dzGussks75PWsnuKzQf4iMJSee31yvDBVvWDmU in sibling:3367 (Hyperbridge Nexus). From now on will be called, the escrow.
The exploit 2M figure DID NOT COME FROM SINGULARITY FUNDS, MERKL or from the fake token dumping from draining the Uniswap pools alone, information that some journalists have claimed erroneously [1(https://www.coingabbar.com/en/crypto-currency-news/hyperbridge-exploit-twist-users-also-lost-funds-in-25m-hack)][2(https://beincrypto.com/hyperbridge-exploit-losses-revised-25m/)], the token dumping only created approximately 108.2 ETH. The bulk of the exploit was mainly occurring on the Polkadot chain. Now it has been proven where the reminder of the Singularity funds went to, when and how much and the reminder is about to be described.
The escrow executes XCM messages from Hyperbridge Nexus a balances.Burned extrinsic event paired with a balances.Minted extrinsic to the beneficiary.
Timeline during the exploit in April 13tth:
Polkadot Assethub Block 14,502,000: at around 04:15 UTC 1,078,728 DOT.
Polkadot Assethub Block 14,503,000: 541,164 DOT.
Polkadot Assethub Block 14,504,000: at around 05:29 UTC 1,218 DOT.
1,077,318 DOT (approximately $1.29M USD valuation at the exploit’s time) was drained in 27 verified withdrawals between 04:16 and 05:29 UTC on the Polkadot chain starting more or less 20 minutes after the Ethereum exploit transaction. Adding with the EVM exploit funds .It amounts approximately to 245 ETH extracted from Hyperbridge’s EVM contract TokenGateway and approximately 108.2 ETH from dumping the 1B minted fake DOT on Ethereum, Base, BNB and Arbitrum’s pools on Uniswap and Pancakeswap. This reconciles with the Hyperbridge team's revised ~$2.5M figure rechecked days after the exploit on: .
https://blog.hyperbridge.network/recovery-and-next-steps/
All 16 destination addresses were freshly created, single-purpose accounts made in the drain window, no prior activity so far. They later hopped to new addresses (for the most part, more on this later):
| Beneficiary | DOT received | First hop (minutes later) | Block(s) |
First Loop + Final Destinations Link:
https://assethub-polkadot.subscan.io/account/12rndBsWAqMQHDk6BosgPB18V1Y5VTY5bcGJozUqiMEFMXwz?tab=transfer
| 16ZsZM5Vt4sFjRP2vgi8TMcWveSDELXvTnaytEfyYsGjBfwY | 182,973 | 12rndBsWAqMQHDk6BosgPB18V1Y5VTY5bcGJozUqiMEFMXwz | 14502345, 14502530, 14502700 |
First Loop + Final Destinations Link:
https://assethub-polkadot.subscan.io/account/12s3CfkEuYzgStnqNhMd3hs4QzBSaLGL9s8KRyiiutvTJTpo?tab=transfer
| 15AfjUoziTich3JhEX9Dtcf9yn6yzjj4edYWhx5osc5H38gK| 161,236 | 12s3CfkEuYzgStnqNhMd3hs4QzBSaLGL9s8KRyiiutvTJTpo | 14502018, 14502186, 14502700 |
First Loop + Final Destinations Link:
https://assethub-polkadot.subscan.io/account/12R8CbCMbLGRR6fhEZLrKLhP6wLuSdzK7bBmEpkuR9DbuSpt?tab=transfer
| 15iKTEFCUjFz2GKYtGDhbNmySJFPEuxHtauWuoYmcBC86YTG | 153,895 | 12R8CbCMbLGRR6fhEZLrKLhP6wLuSdzK7bBmEpkuR9DbuSpt | 14502345, 14502700, 14503677 |
Splits Link:
https://assethub-polkadot.subscan.io/account/13T2iywRFi4Y9cGLJyL98j6JPCAZuRgWcb6ncfZS6n1xHVXF?tab=transfer
| 13T2iywRFi4Y9cGLJyL98j6JPCAZuRgWcb6ncfZS6n1xHVXF | 136,870 | split: 129hVnhxZvC2cqas9u2uZx8pE6NFc7YY8FQrYH8SBoWVKBsD (120,000) + 15CJpoKAnRLjhXU7v1VCWyCQvpEUrwzSnH5nZzKLEr8NMbqT (16,860) | 14503376, 14503482 |
First Loop + Final Destinations Link:
https://assethub-polkadot.subscan.io/account/12Ed4EyfB28vyn79JK2xC22D5fsFPFe6YQuu5NdpbSfBRr53?tab=transfer
| 12Ed4EyfB28vyn79JK2xC22D5fsFPFe6YQuu5NdpbSfBRr53 | 100,000 | the account held for 2 days, then it was transferred to the BC.Game wallet | 14503415 |
Binance sweep and redirection to PoR account.
https://assethub-polkadot.subscan.io/account/15ceDHcfjPfExVw4KfP7icz9zA5K3Yu2tib74qZJ8uLwjuUe?tab=transfer
| 15ceDHcfjPfExVw4KfP7icz9zA5K3Yu2tib74qZJ8uLwjuUe | 100,000 | direct mint to a Binance hot wallet. Automatically redirected to the consolidated wallet | 14503509 |
First Loop + Final Destination Link:
https://assethub-polkadot.subscan.io/account/12NxywW3JuqrGw4yVgUZJTQTzLXeW6RfwePfGccHNAnwZxqV?tab=transfer
| 15vuX9ppVdoZMzZUS62DG6FDBBxRVToucQZ1Zf8jztpa1LNJ | 65,524 | 12NxywW3JuqrGw4yVgUZJTQTzLXeW6RfwePfGccHNAnwZxqV | 14502186, 14503467, 14503566 |
First Loop + Final Destination Link:
https://assethub-polkadot.subscan.io/account/155fj6mCW1Zhnb2XkVBmg5DY8zRmzS6qEApTSoGjapGdNRPc?tab=transfer
| 123PZCTY6bt7GPj18vZxq1HT8r764aAAWhyy2g3rdemcZfk1 | 50,000 | 155fj6mCW1Zhnb2XkVBmg5DY8zRmzS6qEApTSoGjapGdNRPc | 14503461 |
| 12H13LtAfVPmNi26ZDa9nwuLETV4mBsdvotuANUNEQDgJF7d | 47,869 | amount moved to Polkadot Assethub then to the Hydration sovereign account through XCM. No intermediate swap before this | 14503415 |
First Loop + Final Destination Link:
https://assethub-polkadot.subscan.io/account/1511fuSi7mTjwjpnx87L7VRXEgkTnLncMwRc4JriuGhFSnQV?tab=transfer
| 14JWENboWmME3zQ1pAX9QVZEKk7JAhzedoNa2UBeWhaDoGTu | 24,612 | 1511fuSi7mTjwjpnx87L7VRXEgkTnLncMwRc4JriuGhFSnQV | 14503352, 14503494, 14503509 |
Direct deposit:
https://assethub-polkadot.subscan.io/account/121nNFwc1zFnmxAzfjojQB88ZSqo96ABqMccjEaHKjmH63XB?tab=transfer
| 121nNFwc1zFnmxAzfjojQB88ZSqo96ABqMccjEaHKjmH63XB | 20,000 | the account held for 38 days, then it was transferred to the MEXC wallet | 14502700 |
First Loop + Final Destination Link:
https://assethub-polkadot.subscan.io/account/15b4z5gaeSo84C7bgguyjtwekFJHFCBBEKLodvvZUtCjN56F?tab=transfer
| 1qQhmJtRsS27Wiw6H6KD4uvPsYDxMcDNHvVUeWovsRN68yH | 10,000 | 15b4z5gaeSo84C7bgguyjtwekFJHFCBBEKLodvvZUtCjN56F | 14502700 |
First Loop + Final Destination Link to Bitget.com:
https://assethub-polkadot.subscan.io/account/1uUFRJ8D57XebXrmn2QnrNmGHQZWqwpjGpFHfqtSVunh8RU?tab=transfer
| 13BiJnXBRPfzktAKzZUNRGBR5jw2WzwiScXFJ5jarDoEUodt | 10,000 |
1uUFRJ8D57XebXrmn2QnrNmGHQZWqwpjGpFHfqtSVunh8RU | 14503461 |
Looping through Assethub and Hydration + Final Destination Link:
https://assethub-polkadot.subscan.io/account/15CffY61QgFhwjqhE7L8dxBsoquL3DDkjnAXzMcuKmhgKGUp?tab=transfer
| 13bgazCSAZkCFh9LiHwUZs7g863PWMCYxYZXLHUZxpRxFwpE | 7,000 | 15CffY61QgFhwjqhE7L8dxBsoquL3DDkjnAXzMcuKmhgKGUp | 14503352 |
First Loop + Final Destination Link to Fixedfloat:
https://assethub-polkadot.subscan.io/account/13pJFzzrKrser62whCvx8TGRpdcsuvxKpDrH9nXiNAa5ftN?tab=transfer
| 131PzCn8GQhjXAd5Q3H9yPebN2oA6sCBPZK1g4JM9efsz14P | 4,499 | 13pJFzzrKrser62whCvx8TGRpdcsuvxKpDrH9nXiNAa5ftN | 14503533 |
Direct deposit to Bybit.com:
| 16dQK7XqaVz8TiPzStSWTaKjdwSLrPhwstWPmus3bw1nKpaf | 2,840 | 12vhq5Ldcekbcu6ySLZ4naRRupBFQzrGVXYcoxLdXDZFW7ki | 14503461 |
There is a round-number pattern: 100,000, 150,000, 120,000, 50,000 consistent with redemptions of minted tokens. According to the blog, the Hyperbridge team stated that besides the attacker, other opportunistic users, who bought distorted price DOT in drained pools also redeemed through the bridge. This list likely contains both. However, evidence states that it is mostly exploiter coordinated and rehearsed addresses as well as possibly arbitrageurs, bot runners, market players although evidence suggests that only one to three of the participating addresses, might have fallen in the latter group as all the other transactions: amounts, timing and cadence suggest that they mostly all belong to the same attacking entity. There is one well defined attacking cluster and small retrievals to small exchanges that may suggest different smaller and uncorrelated participants, if any. The rehearsal ping suggests otherwise and strengthens the single entity as an attacker. In any case their hypothetical participation is irrelevant to the final picture in both figures and impact.
| Destination | Address | DOT | amount in USD | Evidence |
| Binance (Asset Hub hot wallet) | 13vg3Mrxm3GL9eXxLsGgLYRueiwFCiMbkdHBL4ZN5aob5D4N | 588,900 DOT | ~$705K USD.. | 9 branches forward here within minutes to hours of the drain using the precise methodology with similar timing patterns. The cluster rehearsed the cashing out path.
| BC.Game cluster | deposit wallet 12AGVyQiajrnFpebqERf5psyBdzKB52iFtSHhs3oUihaaomu + operational wallets 12P4Y3hV6r2D7A7saeC9JVfjVpxA757AeDJrGT7u9T6t6KwR, 144HGaYrSdK3543bi26vT6Rd8Bg7pLPMipJNr2WLc3NuHgD2, 15u2N1pqWr56teREjQTP5M3tk1SPQjEoUAV6jFfcQCoVy3S5, 16SxvV2nMdW7yY7Va2Duv99p5EuxpgAiEPtS1p6fbxrLEnah, 12nr7GiDrYHzAYT9L8HdeXnMfWcBuYfAXpgfzf3upujeCciz | ~299,600 DOT | ~$360K USD | 5 branches plus a 100,000 DOT direct deposit in April 15th |
| MEXC (Proof of reserves wallet) | 1NyqRuFPcCXjYneddrmXxKQKSGGTdJSnCQxV3k6Yp2wu6nH | 140,000 DOT | ~$168K USD | 120,000 on Apr 13 + 20,010 on May 21 |
| Hydration (sibling:2034 sovereign through native XCM into the Hydration DEX) | 13cKp89Uh2yWgTG28JA1QEvPUMjEPKejqkjHKf9zqLiFKjH6 | 47,900 DOT | ~$57K USD | 4 transfers Apr 13, 06:02–06:07 UTC. Likely swapped there afterwards. No explorer available as of October 2026. |
| Returned funds to recovery address | 13cKp88n27dzGussks75PWsnuKzQf4iMJSee31yvDBVvWDmU | 45,000 DOT | ~$54K USD | Sent by 123PZ on May 12, 2026 |
Dust + fees + rounding is 1,200 DOT
Total: 1,077,300DOT approximately ~$1.29M USD which matches escrow delta from the beginning between block14,502,000 and 14,504,000 accounting for 1,078,728 DOT that went down to 1,218 DOT in effective possession of the Hyperbridge
Binance branches all within 1 hour of withdrawal:
- 15Afj to 12s3C for 181,360 DOT to Binance (161,236 exploit + 20,164 pre-exploit funds from March. Cash out rehearsal funds)
- 15iKTE to 12R8C for 153,989 DOT to Binance
- 15ceDHcf to 100,003 DOT directly to Binance
- 15vuX9pp to 12NxywW3 for 65,524 DOT to Binance
- 123PZCTY to 155fj6mC for 49,780 DOT to Binance
- 14JWENbo to 1511fuSi for 24,600 DOT to Binance
- 13T2iywR to 15CJpoKA for 16,860 DOT to Binance
- 1qQhmJtR to 15b4z5ga for 9,900 DOT to Binance
- 13bgazCS to 15CffY61 for 7,000 DOT to Binance
BC.Game branches
- 16ZsZ to 12rndB for 135,791 DOT to 12P4Y3hV + 46,700 DOT to 144HGaYr (Apr 13)
- 12Ed4Eyf for 99,999.99 DOT to deposit wallet 12AGVyQi (Apr 15, 10:14 UTC — extrinsic 0x44eb6c2e6673b03c4039e4ac61d3aff68a33c2025ee77b6708b474e7d406a215 at block 14,587,246)
Other micro exchanges
- 13BiJnXB to 1uUFRJ8D for 9,798 DOT to 15u2N1pq Bitget on Apr 13.
- 131PzCn8 to 13pJFzzr for 4,490 DOT to 16SxvV2n Fixedfloat on Apr 13.
- 16dQK7Xq to 12vhq5Ld for 2,841 DOT to 12nr7GiD Bybit on Apr 13.
Attribution note: the BC.Game deposit wallet have additional deposits of 3 digits’ worth of DOT. The smaller deposits into 12AGV on Apr 13–15 for: 250:], 245, 193, 172, 162, 149 DOT came from long-standing regular users with months of prior gambling deposits, therefore they are not considered exploit participants. The BC.Game wallet still holds ~167,886 DOT (plus 1.77M DED, 5,195 USDT) as of Oct 2026. It was noted that BC.game held funds gotten from the exploit and these two are the likeliest candidates. They are both behaviorally connected as well as the three micro exchanges.
15Afj, the largest beneficiary cluster, sent 20,164 DOT to the same forwarder 12s3C on March 18th 2026, the cashing out path was tested a month before the exploit, matching reports of a month-long preparation with 15+ test contracts on EVM.
https://assethub-polkadot.statescan.io/#/accounts/15AfjUoziTich3JhEX9Dtcf9yn6yzjj4edYWhx5osc5H38gK
https://assethub-polkadot.subscan.io/account/15AfjUoziTich3JhEX9Dtcf9yn6yzjj4edYWhx5osc5H38gK?tab=transfer
Three setup wallets were funded by direct withdrawals from Binance's Asset Hub hot wallet. 13vg3 Binance's identify the account behind each withdrawal:
| When (Time in UTC) | Amount in DOT | Recipient | Notes |
| 2026-03-17 08:56 (block 13,502,736) | 0.95 DOT | 15vuX9ppVdoZMzZUS62DG6FDBBxRVToucQZ1Zf8jztpa1LNJ | Setup funding; 0.9 forwarded to 12Nxy, 23 min later. It was later used for the 65,524 DOT exploit flow |
https://assethub-polkadot.statescan.io/#/events/13503369-10
| 2026-03-18 11:19 and 2026-03-18 15:16 | 0.97 + 3.25 DOT | 15uEboSjNPPvfRePs7ygwAqGfzcxbCQsd4bGpeeWBV9qiZNX | Rehearsal wallet with 654 DOT bridge withdrawal within the same day |
https://assethub-polkadot.statescan.io/#/events/13557318-6
| 2026-04-12 08:02 | 666.466 DOT (cool number bro) | 14JWENboWmME3zQ1pAX9QVZEKk7JAhzedoNa2UBeWhaDoGTu | One day before the exploit; it used 667.43 DOT and round tripped back to Binance via 1511f within the same day testing the connectivity and the cashing out path. On exploit’s day it pulled 24,612 DOT form the escrow |
https://assethub-polkadot.statescan.io/#/events/14470412-7
Forwarding wallets that belong to Binance show automatic sweeps to the Binance hot wallet 5–13 minutes after every inbound transaction, it’s the signature of Binance deposit addresses, meaning each maps to a specific Binance account:
12s3CfkEuYzgStnqNhMd3hs4QzBSaLGL9s8KRyiiutvTJTpo — swept 1 DOT (Mar 18 19:52), 5,048.99, 9,999.99, 5,114.99 (Mar 18 rehearsal), then 55,049.99 / 39.99 / 106,145.98 in April 13th
https://assethub-polkadot.statescan.io/#/accounts/12s3CfkEuYzgStnqNhMd3hs4QzBSaLGL9s8KRyiiutvTJTpo?tab=transfers&page=1
12R8CbCMbLGRR6fhEZLrKLhP6wLuSdzK7bBmEpkuR9DbuSpt — rehearsed Mar 18 19:43 (0.9 DOT from 15iKT, moved the funds in 9 min), then 1,099 / 152,100 / 790 in April 13th
12R8CbCMbLGRR6fhEZLrKLhP6wLuSdzK7bBmEpkuR9DbuSpt
https://assethub-polkadot.statescan.io/#/accounts/12R8CbCMbLGRR6fhEZLrKLhP6wLuSdzK7bBmEpkuR9DbuSpt
15ceDHcfjPfExVw4KfP7icz9zA5K3Yu2tib74qZJ8uLwjuUe — a beneficiary that is itself a Binance deposit address: its only two outbounds are auto-sweeps to the hot wallet (100,000 DOT at 05:22; even a 3.28 DOT dust received at 11:45 was swept at 11:52)
https://assethub-polkadot.statescan.io/#/accounts/15ceDHcfjPfExVw4KfP7icz9zA5K3Yu2tib74qZJ8uLwjuUe
12Nxy did 65,524 DOT, 155fj 49,780 DOT, and it was swept at 4 to 12 minutes, 1511f got 24,600 DOT, 15CJp 16,860 DOT, 15b4z 9,900 DOT, 15Cff 7,000 DOT
The cashing out pipeline was rehearsed end-to-end between March 17 and 18 2026, it included a Binance withdrawal then a setup wallet followed by a bridge withdrawal of 50, 654, 5,000 DOT to a Binance deposit address and then a hot wallet all four weeks before the exploit.
129hVnhxZvC2cqas9u2uZx8pE6NFc7YY8FQrYH8SBoWVKBsD swept 120,000 DOT to the MEXC hot wallet within 2 minutes after receiving it, it was another auto-sweep, i.e. a MEXC deposit address tied to a MEXC account.
https://assethub-polkadot.statescan.io/#/accounts/129hVnhxZvC2cqas9u2uZx8pE6NFc7YY8FQrYH8SBoWVKBsD
121nN manually sent 20,010 DOT to the MEXC hot wallet on May 21.
The exploiter anonymized the EVM funding (Tornado Cash) leaving no trail to follow for the common on-chain observer but was on the Polkadot side. Identification leaves exchange information that law enforcement, legal claims, affected users can request:
All identities don’t have a significant amount of prior activity on Polkadot.
The single exception is 16dQK7XqaVz8TiPzStSWTaKjdwSLrPhwstWPmus3bw1nKpaf, the 2,840-DOT beneficiary who deposited to Bybit.com. It is a genuinely legacy account:
https://polkadot.subscan.io/account/16dQK7XqaVz8TiPzStSWTaKjdwSLrPhwstWPmus3bw1nKpaf
Scanning every cluster wallet for activity before April 13, 2026, the attack reveals a sustained preparation campaign across three chains, plus one legacy account with 2021 history.
Bifrost use prior the exploit.
The exploiter's DOT war chest before the exploit came from Bifrost at least 907.7 DOT was moved through Bifrost to Asset Hub on March 30 and April 2nd, 2026, and 836.9 DOT of it was pushed through the Hyperbridge escrow address as a live deposit test.
The exploiter hence had funds and operational familiarity on Bifrost at least two weeks before the Hyperbridge exploit.
Other unexplained older activity.
Mass duster:
https://assethub-polkadot.subscan.io/account/1cG9zmMQZLHgDqnbBG13Pt2Df6PHmBNqG8EYUXQn9EdWa9j?tab=transfer
|121nN | July 29, 2025 | 0.01 DOT mass-duster touch, then dormant until the exploit (MEXC leg, 20K DOT) |
Dusted 0.01 DOT on AssetHub and creating the account in July
https://assethub-polkadot.subscan.io/extrinsic/9376678-2
12H13 has a Binance withdrawal, in July 25, 2024
12H13 (the 47,869-DOT beneficiary to Hydration showed zero pre-exploit transfers or extrinsics on Asset Hub but there was balance on the Relay chain, block 21,795,541 in July 25, 2024 04:36 UTC. 12H13 received .22 DOT from 1qnJN7FViy3HZaxZK9tGAA71zxHSBeUweirKqCaox4t8GT7 labeled Binance by Subscan
https://polkadot.subscan.io/account/1qnJN7FViy3HZaxZK9tGAA71zxHSBeUweirKqCaox4t8GT7.
