<h3 id="summaryofincident">Summary of Incident</h3>
<p>An attacker maliciously upgraded the Parallel parachain runtime, granting themselves administrative privileges. This allowed them to steal over <strong>312,185 DOT</strong> and <strong>126,837 USDT</strong>. The attacker is actively unbonding approximately <strong>125,688 DOT</strong>, putting additional capital at risk in <strong>4 days</strong>. Immediate action is required to vote on a referendum supported by Parity to recover the stolen assets within the next 4 days. The goal is to secure <strong>112M votes with conviction</strong> to prevent further losses. Currently, <strong>26.7M votes</strong> have been collected.</p>
<ul>
<li><strong>Details:</strong> <a href="https://docs.google.com/document/d/1qxGBsAe99avsuj0ArEaDwCGM5nhT5X5P7b6A83x-KuI/edit?tab=t.0#heading=h.54s39aaeu4rx">Incident Report</a></li>
<li><strong>Vote Now:</strong> <a href="https://polkadot.subsquare.io/referenda/1322">Polkadot Referendum #1322</a></li>
</ul>
<hr />
<h3 id="keydetails">Key Details</h3>
<h4 id="attackeractions"><strong>Attacker Actions</strong></h4>
<ol>
<li><strong>Malicious Runtime Upgrade</strong>: Gained "sudo" privileges by <a href="http://52.15.76.25/parallel/extrinsic/6991226-2/events">upgrading</a> the runtime with malicious <a href="http://52.15.76.25/parallel/extrinsic/6991170-3/events">code</a>.</li>
<li><strong>Unauthorized Token Minting</strong>: Created unauthorized <a href="http://52.15.76.25/parallel/extrinsic/7112410-2/events">DOT</a> and <a href="http://52.15.76.25/parallel/extrinsic/7034963-2/events">USDT</a> tokens.</li>
<li><strong>Asset Transfers</strong>: Stolen assets were transferred across <a href="https://polkadot.subscan.io/extrinsic/23594945-2">chains</a> to obfuscate the trail.</li>
<li><strong>Liquidation</strong>: Unstaked funds were sold on exchanges like <a href="https://polkadot.subscan.io/extrinsic/23562402-6">Binance</a> and <a href="https://polkadot.subscan.io/extrinsic/23562969-3">Huobi</a>.</li>
<li><strong>Governance Blockade</strong>: Disabled governance mechanisms to hinder recovery efforts.</li>
</ol>
<h4 id="currentrisk"><strong>Current Risk</strong></h4>
<ul>
<li>The attacker is actively unbonding <strong>125,688+ DOT</strong>, putting over <strong>$1.5M</strong> in additional assets at risk.</li>
<li>Without intervention, these funds will be transferred to the attacker&rsquo;s account.</li>
</ul>
<h4 id="attackeraccounts"><strong>Attacker Accounts</strong></h4>
<ul>
<li>Multiple accounts and addresses across <strong>Polkadot</strong>, <strong>Moonbeam</strong>, and <strong>Acala</strong> were used to facilitate the theft and conceal transactions.</li>
</ul>
<hr />
<h3 id="timelineofevents"><strong>Timeline of Events</strong></h3>
<ul>
<li><strong>October 31, 2024</strong>: Attacker proposed and approved a malicious runtime upgrade, granting themselves administrative powers.</li>
<li><strong>November 7, 2024</strong>: Malicious upgrade executed; attacker gained control of parachain governance and proxy permissions.</li>
<li><strong>November 22-24, 2024</strong>:</li>
<li>Unauthorized minting of DOT and USDT tokens.</li>
<li>Transferred <strong>303,208 DOT</strong> from staking ledgers to attacker-controlled accounts.</li>
<li>Cross-chain transfers and asset swaps to obscure stolen funds.</li>
<li><strong>November 27, 2024</strong>: Continued unbonding of staked DOT, putting additional funds at risk.</li>
<li><strong>November 30, 2024</strong>: All remaining DOT transferred to the Ethereum network. The relaychain now shows zero balance.</li>
</ul>
<hr />
<h3>Exchange Deposit and Cross-chain Activities</h3>
<p>Huobi Deposit Records</p>
<p><a href="https://polkadot.subscan.io/extrinsic/23562969-3">https://polkadot.subscan.io/extrinsic/23562969-3</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23562717-3">https://polkadot.subscan.io/extrinsic/23562717-3</a> 10000 DOT <a href="https://polkadot.subscan.io/extrinsic/23562419-3">https://polkadot.subscan.io/extrinsic/23562419-3</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23562021-2">https://polkadot.subscan.io/extrinsic/23562021-2</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23561741-2">https://polkadot.subscan.io/extrinsic/23561741-2</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23555165-3">https://polkadot.subscan.io/extrinsic/23555165-3</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23554898-2">https://polkadot.subscan.io/extrinsic/23554898-2</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23553897-2">https://polkadot.subscan.io/extrinsic/23553897-2</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23553675-2">https://polkadot.subscan.io/extrinsic/23553675-2</a> 1850 DOT <a href="https://polkadot.subscan.io/extrinsic/23580038-3">https://polkadot.subscan.io/extrinsic/23580038-3</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23585399-3">https://polkadot.subscan.io/extrinsic/23585399-3</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23585574-2">https://polkadot.subscan.io/extrinsic/23585574-2</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23586196-3">https://polkadot.subscan.io/extrinsic/23586196-3</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23585999-2">https://polkadot.subscan.io/extrinsic/23585999-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23585855-2">https://polkadot.subscan.io/extrinsic/23585855-2</a> 1000 DOT</p>
<p>Binance Deposit Records</p>
<p><a href="https://polkadot.subscan.io/extrinsic/23562402-6">https://polkadot.subscan.io/extrinsic/23562402-6</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23562002-8">https://polkadot.subscan.io/extrinsic/23562002-8</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23561704-10">https://polkadot.subscan.io/extrinsic/23561704-10</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23555169-3">https://polkadot.subscan.io/extrinsic/23555169-3</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23554861-4">https://polkadot.subscan.io/extrinsic/23554861-4</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23554219-2">https://polkadot.subscan.io/extrinsic/23554219-2</a> 1850 DOT <a href="https://polkadot.subscan.io/extrinsic/23593355-2">https://polkadot.subscan.io/extrinsic/23593355-2</a> 3700 DOT</p>
<p>FixedFloat Deposit Records</p>
<p><a href="https://polkadot.subscan.io/extrinsic/23562687-4">https://polkadot.subscan.io/extrinsic/23562687-4</a> 3500 DOT <a href="https://polkadot.subscan.io/extrinsic/23562374-3">https://polkadot.subscan.io/extrinsic/23562374-3</a> 3500 DOT <a href="https://polkadot.subscan.io/extrinsic/23561976-9">https://polkadot.subscan.io/extrinsic/23561976-9</a> 3500 DOT <a href="https://polkadot.subscan.io/extrinsic/23561712-3">https://polkadot.subscan.io/extrinsic/23561712-3</a> 3500 DOT <a href="https://polkadot.subscan.io/extrinsic/23553463-2">https://polkadot.subscan.io/extrinsic/23553463-2</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23553419-3">https://polkadot.subscan.io/extrinsic/23553419-3</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23553390-3">https://polkadot.subscan.io/extrinsic/23553390-3</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23316953-2">https://polkadot.subscan.io/extrinsic/23316953-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316293-2">https://polkadot.subscan.io/extrinsic/23316293-2</a> 4000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316253-2">https://polkadot.subscan.io/extrinsic/23316253-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316236-2">https://polkadot.subscan.io/extrinsic/23316236-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316212-2">https://polkadot.subscan.io/extrinsic/23316212-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316188-3">https://polkadot.subscan.io/extrinsic/23316188-3</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316147-2">https://polkadot.subscan.io/extrinsic/23316147-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316089-2">https://polkadot.subscan.io/extrinsic/23316089-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316067-2">https://polkadot.subscan.io/extrinsic/23316067-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316041-2">https://polkadot.subscan.io/extrinsic/23316041-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23580021-2">https://polkadot.subscan.io/extrinsic/23580021-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23585215-2">https://polkadot.subscan.io/extrinsic/23585215-2</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23585498-3">https://polkadot.subscan.io/extrinsic/23585498-3</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23594996-2">https://polkadot.subscan.io/extrinsic/23594996-2</a> 100 DOT <a href="https://polkadot.subscan.io/extrinsic/23595014-2">https://polkadot.subscan.io/extrinsic/23595014-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23595037-2">https://polkadot.subscan.io/extrinsic/23595037-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23595068-3">https://polkadot.subscan.io/extrinsic/23595068-3</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23609031-2">https://polkadot.subscan.io/extrinsic/23609031-2</a> 3000 DOT (11/28)</p>
<p>WhiteBit Deposit Records</p>
<p><a href="https://polkadot.subscan.io/extrinsic/23466096-4">https://polkadot.subscan.io/extrinsic/23466096-4</a> 3000 DOT <a href="https://polkadot.subscan.io/extrinsic/23465666-3">https://polkadot.subscan.io/extrinsic/23465666-3</a> 3000 DOT <a href="https://polkadot.subscan.io/extrinsic/23464980-3">https://polkadot.subscan.io/extrinsic/23464980-3</a> 3000 DOT <a href="https://polkadot.subscan.io/extrinsic/23317105-2">https://polkadot.subscan.io/extrinsic/23317105-2</a> 4000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316529-2">https://polkadot.subscan.io/extrinsic/23316529-2</a> 3000 DOT <a href="https://polkadot.subscan.io/extrinsic/23579972-2">https://polkadot.subscan.io/extrinsic/23579972-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23585207-3">https://polkadot.subscan.io/extrinsic/23585207-3</a> 3700 DOT</p>
<p>To obfuscate the trail, the attacker moved assets across chains</p>
<p><a href="https://polkadot.subscan.io/extrinsic/23594945-2">https://polkadot.subscan.io/extrinsic/23594945-2</a> The hacker first deposited 10,003 DOT to a new address on the Acala parachain: 22EZbDcLVkeGRPsRFRTbWpHAi3tLymN3unv6tpnhqsLiaPkV</p>
<p><a href="https://acala.subscan.io/xcm_message/polkadot-200c01df2b59ce87981452eb50e05799726f3b91">https://acala.subscan.io/xcm_message/polkadot-200c01df2b59ce87981452eb50e05799726f3b91</a> Next, it was cross-chained from the Acala parachain to another new address 12My1JCJeqtzropnC6fMjocvFCTQRw4r2PNnjzMhDKPqkuhM on Polkadot via XCM communication At the new address, the hacker deposited to the exchange again.</p>
<p><a href="https://polkadot.subscan.io/extrinsic/23594996-2">https://polkadot.subscan.io/extrinsic/23594996-2</a> 100 DOT FixedFloat <a href="https://polkadot.subscan.io/extrinsic/23595014-2">https://polkadot.subscan.io/extrinsic/23595014-2</a> 1000 DOT FixedFloat <a href="https://polkadot.subscan.io/extrinsic/23595037-2">https://polkadot.subscan.io/extrinsic/23595037-2</a> 1000 DOT FixedFloat <a href="https://polkadot.subscan.io/extrinsic/23595068-3">https://polkadot.subscan.io/extrinsic/23595068-3</a> 1000 DOT FixedFloat <a href="https://polkadot.subscan.io/extrinsic/23595978-3">https://polkadot.subscan.io/extrinsic/23595978-3</a> Finally, the hacker transferred the remaining 7,000 DOT back to the initial hacker address. Note: The hacker may subsequently use similar actions to "obfuscate the trail" by creating more new addresses to evade monitoring (possibly involving other parachains in the Polkadot ecosystem).</p>
<p>Moving all DOT to Ethereum</p>
<p><a href="https://moonscan.io/address/0xf6b852758a34c31641994ca6b4357b34ad1c18dc#tokentxns">https://moonscan.io/address/0xf6b852758a34c31641994ca6b4357b34ad1c18dc#tokentxns</a> DOT-Moonbeam-Squidrouter <a href="https://etherscan.io/tx/0x3d131a8f255e8a1b7a991f9b3a607ac550c1b5275917d147488c6d3f918da805">https://etherscan.io/tx/0x3d131a8f255e8a1b7a991f9b3a607ac550c1b5275917d147488c6d3f918da805</a> swap to BTC <a href="https://etherscan.io/address/0xf6b852758a34c31641994ca6b4357b34ad1c18dc#internaltx">https://etherscan.io/address/0xf6b852758a34c31641994ca6b4357b34ad1c18dc#internaltx</a> All DOT move to Ethereum account</p>
<hr />
<h3><strong>Impact</strong></h3>
<h4 id="financialloss"><strong>Financial Loss</strong></h4>
<ul>
<li>Over <strong>$3-4M</strong> in stolen assets, with additional <strong>$1-2M</strong> funds at risk.</li>
</ul>
<h4 id="governancedisruption"><strong>Governance Disruption</strong></h4>
<ul>
<li>The attacker disabled democracy and technical committee pallets, preventing upgrades or recovery actions.</li>
</ul>
<h4 id="ecosystemdamage"><strong>Ecosystem Damage</strong></h4>
<ul>
<li>Unauthorized token minting diluted the ecosystem.</li>
<li>Cross-chain transfers further complicated recovery efforts.</li>
</ul>
<hr />
<h3 id="calltoaction"><strong>Call to Action</strong></h3>
<p>The community must urgently vote on the referendum to recover stolen assets within the next <strong>4&nbsp;days</strong>. Securing <strong>112M votes with conviction</strong> is critical to prevent further losses and long-term damage to the ecosystem.</p>
<ul>
<li><strong>Vote Now</strong>: <a href="https://polkadot.subsquare.io/referenda/1322">Polkadot Referendum #1322</a></li>
<li><strong>Additional Information</strong>: <a href="https://x.com/alice_und_bob/status/1862469090654216461?s=46&amp;t=GtuLra8SRZQbc5hjUKgo2Q">Community Post</a></li>
</ul>
<hr />
<h3 id="latestupdate"><strong>Latest Update</strong></h3>
<p>In the past <strong>24 hours</strong>, the hacker transferred all remaining DOT to <strong>Moonbeam</strong> and used cross-chain bridges to move the funds to <strong>Ethereum</strong>. The hacker now holds close to a <strong>zero balance</strong> on Polkadot.</p>
<p>We strongly urge the community to <strong>vote on the proposal</strong> to recover and rebond the remaining <strong>125,000+ DOT</strong> as quickly as possible and regain control of the parachain.</p>
<h3 id="transactiondetails"></h3>

🚨 Critical Alert: We need your help to vote! 200k DOT are at risk of being stolen 🚨

<h3 id="summaryofincident">Summary of Incident</h3>
<p>An attacker maliciously upgraded the Parallel parachain runtime, granting themselves administrative privileges. This allowed them to steal over <strong>312,185 DOT</strong> and <strong>126,837 USDT</strong>. The attacker is actively unbonding approximately <strong>125,688 DOT</strong>, putting additional capital at risk in <strong>4 days</strong>. Immediate action is required to vote on a referendum supported by Parity to recover the stolen assets within the next 4 days. The goal is to secure <strong>112M votes with conviction</strong> to prevent further losses. Currently, <strong>26.7M votes</strong> have been collected.</p>
<ul>
<li><strong>Details:</strong> <a href="https://docs.google.com/document/d/1qxGBsAe99avsuj0ArEaDwCGM5nhT5X5P7b6A83x-KuI/edit?tab=t.0#heading=h.54s39aaeu4rx">Incident Report</a></li>
<li><strong>Vote Now:</strong> <a href="https://polkadot.subsquare.io/referenda/1322">Polkadot Referendum #1322</a></li>
</ul>
<hr />
<h3 id="keydetails">Key Details</h3>
<h4 id="attackeractions"><strong>Attacker Actions</strong></h4>
<ol>
<li><strong>Malicious Runtime Upgrade</strong>: Gained "sudo" privileges by <a href="http://52.15.76.25/parallel/extrinsic/6991226-2/events">upgrading</a> the runtime with malicious <a href="http://52.15.76.25/parallel/extrinsic/6991170-3/events">code</a>.</li>
<li><strong>Unauthorized Token Minting</strong>: Created unauthorized <a href="http://52.15.76.25/parallel/extrinsic/7112410-2/events">DOT</a> and <a href="http://52.15.76.25/parallel/extrinsic/7034963-2/events">USDT</a> tokens.</li>
<li><strong>Asset Transfers</strong>: Stolen assets were transferred across <a href="https://polkadot.subscan.io/extrinsic/23594945-2">chains</a> to obfuscate the trail.</li>
<li><strong>Liquidation</strong>: Unstaked funds were sold on exchanges like <a href="https://polkadot.subscan.io/extrinsic/23562402-6">Binance</a> and <a href="https://polkadot.subscan.io/extrinsic/23562969-3">Huobi</a>.</li>
<li><strong>Governance Blockade</strong>: Disabled governance mechanisms to hinder recovery efforts.</li>
</ol>
<h4 id="currentrisk"><strong>Current Risk</strong></h4>
<ul>
<li>The attacker is actively unbonding <strong>125,688+ DOT</strong>, putting over <strong>$1.5M</strong> in additional assets at risk.</li>
<li>Without intervention, these funds will be transferred to the attacker&rsquo;s account.</li>
</ul>
<h4 id="attackeraccounts"><strong>Attacker Accounts</strong></h4>
<ul>
<li>Multiple accounts and addresses across <strong>Polkadot</strong>, <strong>Moonbeam</strong>, and <strong>Acala</strong> were used to facilitate the theft and conceal transactions.</li>
</ul>
<hr />
<h3 id="timelineofevents"><strong>Timeline of Events</strong></h3>
<ul>
<li><strong>October 31, 2024</strong>: Attacker proposed and approved a malicious runtime upgrade, granting themselves administrative powers.</li>
<li><strong>November 7, 2024</strong>: Malicious upgrade executed; attacker gained control of parachain governance and proxy permissions.</li>
<li><strong>November 22-24, 2024</strong>:</li>
<li>Unauthorized minting of DOT and USDT tokens.</li>
<li>Transferred <strong>303,208 DOT</strong> from staking ledgers to attacker-controlled accounts.</li>
<li>Cross-chain transfers and asset swaps to obscure stolen funds.</li>
<li><strong>November 27, 2024</strong>: Continued unbonding of staked DOT, putting additional funds at risk.</li>
<li><strong>November 30, 2024</strong>: All remaining DOT transferred to the Ethereum network. The relaychain now shows zero balance.</li>
</ul>
<hr />
<h3>Exchange Deposit and Cross-chain Activities</h3>
<p>Huobi Deposit Records</p>
<p><a href="https://polkadot.subscan.io/extrinsic/23562969-3">https://polkadot.subscan.io/extrinsic/23562969-3</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23562717-3">https://polkadot.subscan.io/extrinsic/23562717-3</a> 10000 DOT <a href="https://polkadot.subscan.io/extrinsic/23562419-3">https://polkadot.subscan.io/extrinsic/23562419-3</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23562021-2">https://polkadot.subscan.io/extrinsic/23562021-2</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23561741-2">https://polkadot.subscan.io/extrinsic/23561741-2</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23555165-3">https://polkadot.subscan.io/extrinsic/23555165-3</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23554898-2">https://polkadot.subscan.io/extrinsic/23554898-2</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23553897-2">https://polkadot.subscan.io/extrinsic/23553897-2</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23553675-2">https://polkadot.subscan.io/extrinsic/23553675-2</a> 1850 DOT <a href="https://polkadot.subscan.io/extrinsic/23580038-3">https://polkadot.subscan.io/extrinsic/23580038-3</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23585399-3">https://polkadot.subscan.io/extrinsic/23585399-3</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23585574-2">https://polkadot.subscan.io/extrinsic/23585574-2</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23586196-3">https://polkadot.subscan.io/extrinsic/23586196-3</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23585999-2">https://polkadot.subscan.io/extrinsic/23585999-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23585855-2">https://polkadot.subscan.io/extrinsic/23585855-2</a> 1000 DOT</p>
<p>Binance Deposit Records</p>
<p><a href="https://polkadot.subscan.io/extrinsic/23562402-6">https://polkadot.subscan.io/extrinsic/23562402-6</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23562002-8">https://polkadot.subscan.io/extrinsic/23562002-8</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23561704-10">https://polkadot.subscan.io/extrinsic/23561704-10</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23555169-3">https://polkadot.subscan.io/extrinsic/23555169-3</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23554861-4">https://polkadot.subscan.io/extrinsic/23554861-4</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23554219-2">https://polkadot.subscan.io/extrinsic/23554219-2</a> 1850 DOT <a href="https://polkadot.subscan.io/extrinsic/23593355-2">https://polkadot.subscan.io/extrinsic/23593355-2</a> 3700 DOT</p>
<p>FixedFloat Deposit Records</p>
<p><a href="https://polkadot.subscan.io/extrinsic/23562687-4">https://polkadot.subscan.io/extrinsic/23562687-4</a> 3500 DOT <a href="https://polkadot.subscan.io/extrinsic/23562374-3">https://polkadot.subscan.io/extrinsic/23562374-3</a> 3500 DOT <a href="https://polkadot.subscan.io/extrinsic/23561976-9">https://polkadot.subscan.io/extrinsic/23561976-9</a> 3500 DOT <a href="https://polkadot.subscan.io/extrinsic/23561712-3">https://polkadot.subscan.io/extrinsic/23561712-3</a> 3500 DOT <a href="https://polkadot.subscan.io/extrinsic/23553463-2">https://polkadot.subscan.io/extrinsic/23553463-2</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23553419-3">https://polkadot.subscan.io/extrinsic/23553419-3</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23553390-3">https://polkadot.subscan.io/extrinsic/23553390-3</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23316953-2">https://polkadot.subscan.io/extrinsic/23316953-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316293-2">https://polkadot.subscan.io/extrinsic/23316293-2</a> 4000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316253-2">https://polkadot.subscan.io/extrinsic/23316253-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316236-2">https://polkadot.subscan.io/extrinsic/23316236-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316212-2">https://polkadot.subscan.io/extrinsic/23316212-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316188-3">https://polkadot.subscan.io/extrinsic/23316188-3</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316147-2">https://polkadot.subscan.io/extrinsic/23316147-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316089-2">https://polkadot.subscan.io/extrinsic/23316089-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316067-2">https://polkadot.subscan.io/extrinsic/23316067-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316041-2">https://polkadot.subscan.io/extrinsic/23316041-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23580021-2">https://polkadot.subscan.io/extrinsic/23580021-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23585215-2">https://polkadot.subscan.io/extrinsic/23585215-2</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23585498-3">https://polkadot.subscan.io/extrinsic/23585498-3</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23594996-2">https://polkadot.subscan.io/extrinsic/23594996-2</a> 100 DOT <a href="https://polkadot.subscan.io/extrinsic/23595014-2">https://polkadot.subscan.io/extrinsic/23595014-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23595037-2">https://polkadot.subscan.io/extrinsic/23595037-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23595068-3">https://polkadot.subscan.io/extrinsic/23595068-3</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23609031-2">https://polkadot.subscan.io/extrinsic/23609031-2</a> 3000 DOT (11/28)</p>
<p>WhiteBit Deposit Records</p>
<p><a href="https://polkadot.subscan.io/extrinsic/23466096-4">https://polkadot.subscan.io/extrinsic/23466096-4</a> 3000 DOT <a href="https://polkadot.subscan.io/extrinsic/23465666-3">https://polkadot.subscan.io/extrinsic/23465666-3</a> 3000 DOT <a href="https://polkadot.subscan.io/extrinsic/23464980-3">https://polkadot.subscan.io/extrinsic/23464980-3</a> 3000 DOT <a href="https://polkadot.subscan.io/extrinsic/23317105-2">https://polkadot.subscan.io/extrinsic/23317105-2</a> 4000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316529-2">https://polkadot.subscan.io/extrinsic/23316529-2</a> 3000 DOT <a href="https://polkadot.subscan.io/extrinsic/23579972-2">https://polkadot.subscan.io/extrinsic/23579972-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23585207-3">https://polkadot.subscan.io/extrinsic/23585207-3</a> 3700 DOT</p>
<p>To obfuscate the trail, the attacker moved assets across chains</p>
<p><a href="https://polkadot.subscan.io/extrinsic/23594945-2">https://polkadot.subscan.io/extrinsic/23594945-2</a> The hacker first deposited 10,003 DOT to a new address on the Acala parachain: 22EZbDcLVkeGRPsRFRTbWpHAi3tLymN3unv6tpnhqsLiaPkV</p>
<p><a href="https://acala.subscan.io/xcm_message/polkadot-200c01df2b59ce87981452eb50e05799726f3b91">https://acala.subscan.io/xcm_message/polkadot-200c01df2b59ce87981452eb50e05799726f3b91</a> Next, it was cross-chained from the Acala parachain to another new address 12My1JCJeqtzropnC6fMjocvFCTQRw4r2PNnjzMhDKPqkuhM on Polkadot via XCM communication At the new address, the hacker deposited to the exchange again.</p>
<p><a href="https://polkadot.subscan.io/extrinsic/23594996-2">https://polkadot.subscan.io/extrinsic/23594996-2</a> 100 DOT FixedFloat <a href="https://polkadot.subscan.io/extrinsic/23595014-2">https://polkadot.subscan.io/extrinsic/23595014-2</a> 1000 DOT FixedFloat <a href="https://polkadot.subscan.io/extrinsic/23595037-2">https://polkadot.subscan.io/extrinsic/23595037-2</a> 1000 DOT FixedFloat <a href="https://polkadot.subscan.io/extrinsic/23595068-3">https://polkadot.subscan.io/extrinsic/23595068-3</a> 1000 DOT FixedFloat <a href="https://polkadot.subscan.io/extrinsic/23595978-3">https://polkadot.subscan.io/extrinsic/23595978-3</a> Finally, the hacker transferred the remaining 7,000 DOT back to the initial hacker address. Note: The hacker may subsequently use similar actions to "obfuscate the trail" by creating more new addresses to evade monitoring (possibly involving other parachains in the Polkadot ecosystem).</p>
<p>Moving all DOT to Ethereum</p>
<p><a href="https://moonscan.io/address/0xf6b852758a34c31641994ca6b4357b34ad1c18dc#tokentxns">https://moonscan.io/address/0xf6b852758a34c31641994ca6b4357b34ad1c18dc#tokentxns</a> DOT-Moonbeam-Squidrouter <a href="https://etherscan.io/tx/0x3d131a8f255e8a1b7a991f9b3a607ac550c1b5275917d147488c6d3f918da805">https://etherscan.io/tx/0x3d131a8f255e8a1b7a991f9b3a607ac550c1b5275917d147488c6d3f918da805</a> swap to BTC <a href="https://etherscan.io/address/0xf6b852758a34c31641994ca6b4357b34ad1c18dc#internaltx">https://etherscan.io/address/0xf6b852758a34c31641994ca6b4357b34ad1c18dc#internaltx</a> All DOT move to Ethereum account</p>
<hr />
<h3><strong>&nbsp;</strong><strong>Impact</strong></h3>
<h4 id="financialloss"><strong>Financial Loss</strong></h4>
<ul>
<li>Over <strong>$3-4M</strong> in stolen assets, with additional $1-2M funds at risk.</li>
</ul>
<h4 id="governancedisruption"><strong>Governance Disruption</strong></h4>
<ul>
<li>The attacker disabled democracy and technical committee pallets, preventing upgrades or recovery actions.</li>
</ul>
<h4 id="ecosystemdamage"><strong>Ecosystem Damage</strong></h4>
<ul>
<li>Unauthorized token minting diluted the ecosystem.</li>
<li>Cross-chain transfers further complicated recovery efforts.</li>
</ul>
<hr />
<h3 id="calltoaction"><strong>Call to Action</strong></h3>
<p>The community must urgently vote on the referendum to recover stolen assets within the next <strong>5 days</strong>. Securing <strong>112M votes with conviction</strong> is critical to prevent further losses and long-term damage to the ecosystem.</p>
<ul>
<li><strong>Vote Now</strong>: <a href="https://polkadot.subsquare.io/referenda/1322">Polkadot Referendum #1322</a></li>
<li><strong>Additional Information</strong>: <a href="https://x.com/alice_und_bob/status/1862469090654216461?s=46&amp;t=GtuLra8SRZQbc5hjUKgo2Q">Community Post</a></li>
</ul>
<hr />
<h3 id="latestupdate"><strong>Latest Update</strong></h3>
<p>In the past <strong>24 hours</strong>, the hacker transferred all remaining DOT to <strong>Moonbeam</strong> and used cross-chain bridges to move the funds to <strong>Ethereum</strong>. The hacker now holds close to a <strong>zero balance</strong> on Polkadot.</p>
<p>We strongly urge the community to <strong>vote on the proposal</strong> to recover and rebond the remaining <strong>125,000+ DOT</strong> as quickly as possible and regain control of the parachain.</p>
<h3 id="transactiondetails"></h3>

<h3 id="summaryofincident">Summary of Incident</h3>
<p>An attacker maliciously upgraded the Parallel parachain runtime, granting themselves administrative privileges. This allowed them to steal over <strong>312,185 DOT</strong> and <strong>126,837 USDT</strong>. The attacker is actively unbonding approximately <strong>125,688 DOT</strong>, putting additional capital at risk in <strong>4 days</strong>. Immediate action is required to vote on a referendum supported by Parity to recover the stolen assets within the next 4 days. The goal is to secure <strong>112M votes with conviction</strong> to prevent further losses. Currently, <strong>26.7M votes</strong> have been collected.</p>
<ul>
<li><strong>Details:</strong> <a href="https://docs.google.com/document/d/1qxGBsAe99avsuj0ArEaDwCGM5nhT5X5P7b6A83x-KuI/edit?tab=t.0#heading=h.54s39aaeu4rx">Incident Report</a></li>
<li>Key Activities: <a href="https://docs.google.com/document/d/1bMUn-GHHgjlldYtwsEn7BvqUrRgz0U7w2GFPbI4xVb8/edit?tab=t.0">Activities Report</a></li>
<li><strong>Vote Now:</strong> <a href="https://polkadot.subsquare.io/referenda/1322">Polkadot Referendum #1322</a></li>
</ul>
<hr />
<h3 id="keydetails">Key Details</h3>
<h4 id="attackeractions"><strong>Attacker Actions</strong></h4>
<ol>
<li><strong>Malicious Runtime Upgrade</strong>: Gained "sudo" privileges by <a href="http://52.15.76.25/parallel/extrinsic/6991226-2/events">upgrading</a> the runtime with malicious <a href="http://52.15.76.25/parallel/extrinsic/6991170-3/events">code</a>.</li>
<li><strong>Unauthorized Token Minting</strong>: Created unauthorized <a href="http://52.15.76.25/parallel/extrinsic/7112410-2/events">DOT</a> and <a href="http://52.15.76.25/parallel/extrinsic/7034963-2/events">USDT</a> tokens.</li>
<li><strong>Asset Transfers</strong>: Stolen assets were transferred across <a href="https://polkadot.subscan.io/extrinsic/23594945-2">chains</a> to obfuscate the trail.</li>
<li><strong>Liquidation</strong>: Unstaked funds were sold on exchanges like <a href="https://polkadot.subscan.io/extrinsic/23562402-6">Binance</a> and <a href="https://polkadot.subscan.io/extrinsic/23562969-3">Huobi</a>.</li>
<li><strong>Governance Blockade</strong>: Disabled governance mechanisms to hinder recovery efforts.</li>
</ol>
<h4 id="currentrisk"><strong>Current Risk</strong></h4>
<ul>
<li>The attacker is actively unbonding <strong>125,688+ DOT</strong>, putting over <strong>$1.5M</strong> in additional assets at risk.</li>
<li>Without intervention, these funds will be transferred to the attacker&rsquo;s account.</li>
</ul>
<h4 id="attackeraccounts"><strong>Attacker Accounts</strong></h4>
<ul>
<li>Multiple accounts and addresses across <strong>Polkadot</strong>, <strong>Moonbeam</strong>, and <strong>Acala</strong> were used to facilitate the theft and conceal transactions.</li>
</ul>
<hr />
<h3 id="timelineofevents"><strong>Timeline of Events</strong></h3>
<ul>
<li><strong>October 31, 2024</strong>: Attacker proposed and approved a malicious runtime upgrade, granting themselves administrative powers.</li>
<li><strong>November 7, 2024</strong>: Malicious upgrade executed; attacker gained control of parachain governance and proxy permissions.</li>
<li><strong>November 22-24, 2024</strong>:</li>
<li>Unauthorized minting of DOT and USDT tokens.</li>
<li>Transferred <strong>303,208 DOT</strong> from staking ledgers to attacker-controlled accounts.</li>
<li>Cross-chain transfers and asset swaps to obscure stolen funds.</li>
<li><strong>November 27, 2024</strong>: Continued unbonding of staked DOT, putting additional funds at risk.</li>
<li><strong>November 30, 2024</strong>: All remaining DOT transferred to the Ethereum network. The relaychain now shows zero balance.</li>
</ul>
<hr />
<h3>Exchange Deposit and Cross-chain Activities</h3>
<p>Huobi Deposit Records</p>
<p><a href="https://polkadot.subscan.io/extrinsic/23562969-3">https://polkadot.subscan.io/extrinsic/23562969-3</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23562717-3">https://polkadot.subscan.io/extrinsic/23562717-3</a> 10000 DOT <a href="https://polkadot.subscan.io/extrinsic/23562419-3">https://polkadot.subscan.io/extrinsic/23562419-3</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23562021-2">https://polkadot.subscan.io/extrinsic/23562021-2</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23561741-2">https://polkadot.subscan.io/extrinsic/23561741-2</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23555165-3">https://polkadot.subscan.io/extrinsic/23555165-3</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23554898-2">https://polkadot.subscan.io/extrinsic/23554898-2</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23553897-2">https://polkadot.subscan.io/extrinsic/23553897-2</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23553675-2">https://polkadot.subscan.io/extrinsic/23553675-2</a> 1850 DOT <a href="https://polkadot.subscan.io/extrinsic/23580038-3">https://polkadot.subscan.io/extrinsic/23580038-3</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23585399-3">https://polkadot.subscan.io/extrinsic/23585399-3</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23585574-2">https://polkadot.subscan.io/extrinsic/23585574-2</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23586196-3">https://polkadot.subscan.io/extrinsic/23586196-3</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23585999-2">https://polkadot.subscan.io/extrinsic/23585999-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23585855-2">https://polkadot.subscan.io/extrinsic/23585855-2</a> 1000 DOT</p>
<p>Binance Deposit Records</p>
<p><a href="https://polkadot.subscan.io/extrinsic/23562402-6">https://polkadot.subscan.io/extrinsic/23562402-6</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23562002-8">https://polkadot.subscan.io/extrinsic/23562002-8</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23561704-10">https://polkadot.subscan.io/extrinsic/23561704-10</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23555169-3">https://polkadot.subscan.io/extrinsic/23555169-3</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23554861-4">https://polkadot.subscan.io/extrinsic/23554861-4</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23554219-2">https://polkadot.subscan.io/extrinsic/23554219-2</a> 1850 DOT <a href="https://polkadot.subscan.io/extrinsic/23593355-2">https://polkadot.subscan.io/extrinsic/23593355-2</a> 3700 DOT</p>
<p>FixedFloat Deposit Records</p>
<p><a href="https://polkadot.subscan.io/extrinsic/23562687-4">https://polkadot.subscan.io/extrinsic/23562687-4</a> 3500 DOT <a href="https://polkadot.subscan.io/extrinsic/23562374-3">https://polkadot.subscan.io/extrinsic/23562374-3</a> 3500 DOT <a href="https://polkadot.subscan.io/extrinsic/23561976-9">https://polkadot.subscan.io/extrinsic/23561976-9</a> 3500 DOT <a href="https://polkadot.subscan.io/extrinsic/23561712-3">https://polkadot.subscan.io/extrinsic/23561712-3</a> 3500 DOT <a href="https://polkadot.subscan.io/extrinsic/23553463-2">https://polkadot.subscan.io/extrinsic/23553463-2</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23553419-3">https://polkadot.subscan.io/extrinsic/23553419-3</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23553390-3">https://polkadot.subscan.io/extrinsic/23553390-3</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23316953-2">https://polkadot.subscan.io/extrinsic/23316953-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316293-2">https://polkadot.subscan.io/extrinsic/23316293-2</a> 4000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316253-2">https://polkadot.subscan.io/extrinsic/23316253-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316236-2">https://polkadot.subscan.io/extrinsic/23316236-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316212-2">https://polkadot.subscan.io/extrinsic/23316212-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316188-3">https://polkadot.subscan.io/extrinsic/23316188-3</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316147-2">https://polkadot.subscan.io/extrinsic/23316147-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316089-2">https://polkadot.subscan.io/extrinsic/23316089-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316067-2">https://polkadot.subscan.io/extrinsic/23316067-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316041-2">https://polkadot.subscan.io/extrinsic/23316041-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23580021-2">https://polkadot.subscan.io/extrinsic/23580021-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23585215-2">https://polkadot.subscan.io/extrinsic/23585215-2</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23585498-3">https://polkadot.subscan.io/extrinsic/23585498-3</a> 3700 DOT <a href="https://polkadot.subscan.io/extrinsic/23594996-2">https://polkadot.subscan.io/extrinsic/23594996-2</a> 100 DOT <a href="https://polkadot.subscan.io/extrinsic/23595014-2">https://polkadot.subscan.io/extrinsic/23595014-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23595037-2">https://polkadot.subscan.io/extrinsic/23595037-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23595068-3">https://polkadot.subscan.io/extrinsic/23595068-3</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23609031-2">https://polkadot.subscan.io/extrinsic/23609031-2</a> 3000 DOT (11/28)</p>
<p>WhiteBit Deposit Records</p>
<p><a href="https://polkadot.subscan.io/extrinsic/23466096-4">https://polkadot.subscan.io/extrinsic/23466096-4</a> 3000 DOT <a href="https://polkadot.subscan.io/extrinsic/23465666-3">https://polkadot.subscan.io/extrinsic/23465666-3</a> 3000 DOT <a href="https://polkadot.subscan.io/extrinsic/23464980-3">https://polkadot.subscan.io/extrinsic/23464980-3</a> 3000 DOT <a href="https://polkadot.subscan.io/extrinsic/23317105-2">https://polkadot.subscan.io/extrinsic/23317105-2</a> 4000 DOT <a href="https://polkadot.subscan.io/extrinsic/23316529-2">https://polkadot.subscan.io/extrinsic/23316529-2</a> 3000 DOT <a href="https://polkadot.subscan.io/extrinsic/23579972-2">https://polkadot.subscan.io/extrinsic/23579972-2</a> 1000 DOT <a href="https://polkadot.subscan.io/extrinsic/23585207-3">https://polkadot.subscan.io/extrinsic/23585207-3</a> 3700 DOT</p>
<p>To obfuscate the trail, the attacker moved assets across chains</p>
<p><a href="https://polkadot.subscan.io/extrinsic/23594945-2">https://polkadot.subscan.io/extrinsic/23594945-2</a> The hacker first deposited 10,003 DOT to a new address on the Acala parachain: 22EZbDcLVkeGRPsRFRTbWpHAi3tLymN3unv6tpnhqsLiaPkV</p>
<p><a href="https://acala.subscan.io/xcm_message/polkadot-200c01df2b59ce87981452eb50e05799726f3b91">https://acala.subscan.io/xcm_message/polkadot-200c01df2b59ce87981452eb50e05799726f3b91</a> Next, it was cross-chained from the Acala parachain to another new address 12My1JCJeqtzropnC6fMjocvFCTQRw4r2PNnjzMhDKPqkuhM on Polkadot via XCM communication At the new address, the hacker deposited to the exchange again.</p>
<p><a href="https://polkadot.subscan.io/extrinsic/23594996-2">https://polkadot.subscan.io/extrinsic/23594996-2</a> 100 DOT FixedFloat <a href="https://polkadot.subscan.io/extrinsic/23595014-2">https://polkadot.subscan.io/extrinsic/23595014-2</a> 1000 DOT FixedFloat <a href="https://polkadot.subscan.io/extrinsic/23595037-2">https://polkadot.subscan.io/extrinsic/23595037-2</a> 1000 DOT FixedFloat <a href="https://polkadot.subscan.io/extrinsic/23595068-3">https://polkadot.subscan.io/extrinsic/23595068-3</a> 1000 DOT FixedFloat <a href="https://polkadot.subscan.io/extrinsic/23595978-3">https://polkadot.subscan.io/extrinsic/23595978-3</a> Finally, the hacker transferred the remaining 7,000 DOT back to the initial hacker address. Note: The hacker may subsequently use similar actions to "obfuscate the trail" by creating more new addresses to evade monitoring (possibly involving other parachains in the Polkadot ecosystem).</p>
<p>Moving all DOT to Ethereum</p>
<p><a href="https://moonscan.io/address/0xf6b852758a34c31641994ca6b4357b34ad1c18dc#tokentxns">https://moonscan.io/address/0xf6b852758a34c31641994ca6b4357b34ad1c18dc#tokentxns</a> DOT-Moonbeam-Squidrouter <a href="https://etherscan.io/tx/0x3d131a8f255e8a1b7a991f9b3a607ac550c1b5275917d147488c6d3f918da805">https://etherscan.io/tx/0x3d131a8f255e8a1b7a991f9b3a607ac550c1b5275917d147488c6d3f918da805</a> swap to BTC <a href="https://etherscan.io/address/0xf6b852758a34c31641994ca6b4357b34ad1c18dc#internaltx">https://etherscan.io/address/0xf6b852758a34c31641994ca6b4357b34ad1c18dc#internaltx</a> All DOT move to Ethereum account</p>
<hr />
<h3><strong>&nbsp;</strong><strong>Impact</strong></h3>
<h4 id="financialloss"><strong>Financial Loss</strong></h4>
<ul>
<li>Over <strong>$3-4M</strong> in stolen assets, with additional $1-2M funds at risk.</li>
</ul>
<h4 id="governancedisruption"><strong>Governance Disruption</strong></h4>
<ul>
<li>The attacker disabled democracy and technical committee pallets, preventing upgrades or recovery actions.</li>
</ul>
<h4 id="ecosystemdamage"><strong>Ecosystem Damage</strong></h4>
<ul>
<li>Unauthorized token minting diluted the ecosystem.</li>
<li>Cross-chain transfers further complicated recovery efforts.</li>
</ul>
<hr />
<h3 id="calltoaction"><strong>Call to Action</strong></h3>
<p>The community must urgently vote on the referendum to recover stolen assets within the next <strong>5 days</strong>. Securing <strong>112M votes with conviction</strong> is critical to prevent further losses and long-term damage to the ecosystem.</p>
<ul>
<li><strong>Vote Now</strong>: <a href="https://polkadot.subsquare.io/referenda/1322">Polkadot Referendum #1322</a></li>
<li><strong>Additional Information</strong>: <a href="https://x.com/alice_und_bob/status/1862469090654216461?s=46&amp;t=GtuLra8SRZQbc5hjUKgo2Q">Community Post</a></li>
</ul>
<hr />
<h3 id="latestupdate"><strong>Latest Update</strong></h3>
<p>In the past <strong>24 hours</strong>, the hacker transferred all remaining DOT to <strong>Moonbeam</strong> and used cross-chain bridges to move the funds to <strong>Ethereum</strong>. The hacker now holds close to a <strong>zero balance</strong> on Polkadot.</p>
<p>We strongly urge the community to <strong>vote on the proposal</strong> to recover and rebond the remaining <strong>125,000+ DOT</strong> as quickly as possible and regain control of the parachain.</p>
<h3 id="transactiondetails"></h3>

- **Problem Statement:** Immediate action is needed to recover stolen assets totaling over 312,185 DOT and 126,837 USDT, with an additional 125,688 DOT at risk, requiring 112M votes to prevent further losses.
- **Significance:** Financial loss of over $3-4M, governance disruption, and ecosystem damage due to unauthorized token minting and cross-chain transfers.
- **Proposed Solution:** Urgent voting on a referendum supported by Parity within 4 days to secure the required votes for asset recovery.
- **Expected Outcomes:** Prevent further financial losses, regain control of the parachain, and mitigate long-term damage to the ecosystem.

#2591 🚨 Critical Alert: We need your help to vote and upgrade runtime! 200k DOT are at risk of being stolen 🚨

No Active Proposals