Hyperbridge — MMR Proof Verification Flaw / Forged ISMP PostRequest

Timeline: April 13, 2026 — Phase 1: attacker extracts 245 ETH from Token Gateway via first proof forgery. ~1 hour later — Phase 2: attacker forges an ISMP PostRequest by exploiting an edge-case in solidity-merkle-trees MerkleMountainRange.CalculateRoot (when leafCount == 1 and leaf_index == 1, stale historical root promoted as valid). Mints 1,000,000,000 bridged DOT, dumps atomically into 108.2 ETH (tx: 0x240aeb…1109). Token Gateway drained. Hyperbridge pauses all bridging operations. BlockSec Phalcon publishes root cause on X. April 16 — Post-mortem revises losses to ~$2.5M across 4 EVM chains. Compensation in BRIDGE token planned for April 13, 2027 if recovery insufficient.