A hacker minted $1.1 billion in Polkadot-based tokens through an Ethereum bridge exploit but has converted only $237,000 into withdrawable funds, according to the report first carried by Yahoo Finance.

The gap between the two figures defines the incident. The attacker inflated a token supply across the bridge, yet the bridge's withdrawal and verification controls capped how much of that newly minted value could leave the system as spendable assets.

What happened on the bridge?

The exploit targeted the mechanism that connects Ethereum to Polkadot. Cross-chain bridges verify and relay asset movements between otherwise disconnected networks. When a bridge's validation logic fails, an attacker can often mint unbacked tokens on the receiving chain — tokens that exist on-chain but carry no corresponding collateral on the source chain.

That is the pattern here. The $1.1 billion figure represents tokens created through the compromised bridging path, not value extracted from other users' deposits.

Why could only $237K be cashed out?

The answer lies in how bridges quarantine unbacked minting. Once irregular minting is detected, operators and automated circuit breakers can freeze bridge withdrawals, leaving attacker-controlled balances stranded on the destination chain. Unbacked tokens also cannot circulate at face value on liquid markets, since exchanges and market makers price them against verified supply.

The result: a headline number in the billions, a realized loss below a quarter of a million dollars. For the protocol's operators, the incident functions as a stress test — one where the damage cap worked, even though the minting itself succeeded.

What does this mean for bridge security?

The exploit adds to a long record of bridge failures, the single largest category of losses in crypto's history by value extracted. Bridge designs differ in how they verify cross-chain messages: trusted multisignature committees, optimistic verification, and light-client proofs each carry different failure modes.

In this case, the minting path broke while the exit path held. That asymmetry spared users and the protocol's treasury from a nine-figure loss. It also leaves open the question of which validation layer permitted the mint — a detail operators will need to disclose before the bridge can safely resume full operations.

What comes next?

Expect the bridge operator to publish a post-mortem identifying the vulnerable contract, pause affected routes, and decide whether to roll back the fraudulent mint or burn the unbacked supply. Watch also for any exchange-level freezes on wallets linked to the $237,000 already extracted, the only portion of the attack that has produced real losses so far.