Polkadot Treasury Lost $1.38M to a Bug Parity Already Fixed

A Fix That Existed on Paper but Never Shipped

Parity Technologies released an incident report confirming that Polkadot’s Treasury lost approximately $1.381 million across a two-day attack running from October 24 to 26. The attacker exploited a flaw inside XCM, Polkadot’s cross-chain messaging system – the same flaw Parity had already corrected in its codebase back in June. The patch missed the stable-2606 cutoff and never reached the production runtimes where it would have mattered.

No user funds were touched.

The exploit targeted dotUSD, Polkadot’s decentralized stablecoin that launched in October. By manipulating dotUSD’s recorded supply without altering actual account balances, the attacker distorted the DOT/dotUSD liquidity pool enough to swap dotUSD for DOT at artificial rates. Because the Treasury served as the pool’s sole liquidity provider, losses landed entirely there rather than with ordinary holders. dotUSD remained fully backed by USDT throughout. Snowfork halted its own relayers on October 24 once the issue surfaced, but the attacker ran a private relayer and kept operating until roughly six hours before runtime 2.5.1 – carrying the XCM fix – took effect. Runtime 2.5.2, enacted October 30, corrected the supply distortion. Parity initially classified the underlying bug as medium severity before upgrading the rating to critical, and the company has since announced an overhaul of its security processes. Who walked away with the profits remains unresolved.

DOT’s Chart Was Already Broken Before the News Hit

The incident report landed on a DOT chart that had been sliding for weeks before anyone heard the word “exploit.” DOT trades near $0.95, down roughly 6% over the past seven days, but the more telling number is the 23% decline over the past month. The exploit did not create a weak chart – it arrived at one.

Both major moving averages now sit above price, flipping from support into resistance. The 50-day moving average is near $1.05. The 200-day sits higher, around $1.16. Any rally toward either line runs directly into a zone where sellers have been active, which caps the upside before it can build any real momentum. The Relative Strength Index reads 38 – below the neutral midpoint of 50, but still above the oversold threshold of 30. That positioning is significant: sellers have clear control, yet the market has not reached the kind of exhausted, washed-out level that historically attracts buyers looking for discounted entry points. Momentum continues pointing downward, and the prevailing trend favors sellers across multiple signals.

The nearest floor on the daily chart sits around $0.87. A decisive break below that level would expose the next support near $0.81 – territory that would place DOT at fresh yearly lows. For bulls, the conversation about recovery does not start until DOT closes a full trading day above $1.00. That round number represents both psychological importance and the nearest meaningful resistance. Clearing it would not end the bearish structure, but it would at least reduce immediate selling pressure. The next obstacle after that stands near $1.14, just beneath the 200-day moving average.

XLM Drifts Lower With Nothing Specific to Blame

Stellar’s XLM tells a quieter but structurally similar story. The token trades near $0.17, down about 3% on the week and roughly 22% over the past month. Unlike DOT, XLM carries no exploit narrative – it is simply moving in the same direction as the broader market, pulled down by sector-wide pressure rather than any project-specific event.

The technical picture mirrors DOT in its broad outline. XLM trades below both its 50-day moving average, near $0.18, and its 200-day moving average positioned slightly above that. Both lines act as overhead resistance. Price is also pressing directly against nearby resistance, which leaves buyers with almost no room to build a case before hitting supply. That compressed space between current price and resistance means any bounce faces immediate headwinds.

The 3% weekly decline is mild compared to some assets in the sector, and sellers appear to be losing some grip at current levels, but the ceiling remains low. Bitcoin’s own stalled momentum at higher levels has done little to generate the kind of broad market lift that typically helps mid-cap tokens like XLM recover from extended slides. Without a catalyst specific to Stellar’s ecosystem, XLM is essentially a passenger in whatever the wider market decides to do next.

Polkadot faces a harder road than XLM because it carries both a damaged chart and an unresolved story – the attacker’s identity and final profit figures are still unknown, and Parity’s security overhaul is still underway. A bug that was fixed in June but never deployed cost the Treasury $1.381 million and left open the question of what else might be sitting in the codebase, patched on a branch but waiting to miss another deadline.