Parallel Response: Securing Assets and Supporting Users
In October, an exploiter targeted the Parallel parachain runtime, successfully moving approximately 300,000 DOT and 100,000 USDT. The security breach resulted in the unauthorized transfer of assets, leading to significant losses within the Parallel ecosystem.
Polkadot Community’s Response
Following the breach, Referendum 1424 was introduced, aiming to update the runtime to allow Parallel to recover some of the stolen DOT. However, by the time this proposal gained traction, the attacker had already moved the funds beyond reach. In an attempt to buy time, Referendum 1445 re-bonded DOT across several accounts, delaying the attacker’s access. Unfortunately, the attacker leveraged fast-unstake to bypass Polkadot’s standard 28-day unstaking period, accelerating the liquidation process.
Tracing the Funds
On February 26, the attacker consolidated DOT from multiple accounts into a single address, swapping the vast majority for USDC. The USDC was subsequently moved to Moonbeam, a well known Ethereum compatible parachain within the Polkadot ecosystem.
- Polkadot Subscan records:https://polkadot.subscan.io/xcm_transfer?address=16cm11H5g5ZgiaqGL6FYDQVDFGPfujLe8kadQA36BdcTuwRt
- Moonscan transactions:https://moonscan.io/address/0xF6B852758a34c31641994CA6B4357B34ad1C18dC#tokentxns
The USDC was then moved out of the Polkadot ecosystem via Axelar, making recovery efforts significantly more complex.
Law Enforcement Steps In
In response to the breach, authorities in Hong Kong have been contacted and are actively involved in the investigation, working alongside blockchain analysts and Parallel’s security team to trace and recover the stolen assets. Efforts are being made to identify the attacker and potentially compensate affected users.
While Polkadot governance mechanisms attempted to mitigate the situation through referendums, the rapid movement of funds and cross-chain transfers have complicated recovery efforts. This incident highlights the challenges of securing decentralized networks while maintaining governance integrity.
Next Steps
Parallel and the Polkadot community are dedicated to supporting affected users and ensuring they receive compensation. We’re working closely with law enforcement, security experts, and blockchain analysts to track the stolen funds and explore recovery options. We’ll provide ongoing updates and remain transparent throughout the process.
If you have been affected, please join our official Discord at https://discord.gg/parallelfi and open a support ticket. Our team is here to assist you, answer your questions, and ensure that your concerns are addressed with the urgency they deserve.
As Tom stated when joining Parallel “while we can’t change the past, we can shape the future.” Our focus is on rebuilding trust, strengthening security, and building the leading products in DeFi. We stand by our community and will continue working toward a resolution that protects and compensates those impacted. Thank you for your patience and support as we move forward together.
