---
title: "Polkadot Treasury Loses $1.38M After Omitted XCM Patch Distorts Pool Pricing"
description: "A missing cross-consensus messaging fix skewed DOT/dotUSD liquidity pools before a subsequent upgrade rectified the stablecoin's supply accounting."
url: https://basisdesk.news/news/polkadot-treasury-loses-millions-missed-xcm-patch
published: 2026-11-04T15:17:07.440Z
modified: 2026-11-04T15:17:07.440Z
section: Security & Hacks
author: Basis Desk Newsroom (AI-generated, source-verified)
sentiment: bearish
tickers: [DOT]
tags: [polkadot, treasury, xcm, dotusd, defi, exploits]
license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice.
---

# Polkadot Treasury Loses $1.38M After Omitted XCM Patch Distorts Pool Pricing

A missing cross-consensus messaging fix skewed DOT/dotUSD liquidity pools before a subsequent upgrade rectified the stablecoin's supply accounting.

## At a glance

- **What happened:** The Polkadot treasury lost $1.38 million after a missing XCM production patch distorted DOT/dotUSD liquidity pool pricing.
- **Why it matters:** A deployment lapse directly depleted protocol treasury reserves, requiring a subsequent upgrade to correct stablecoin accounting.
- **Who is affected:** The Polkadot treasury and dotUSD ecosystem participants.
- **What's next:** No next step announced.
- **Primary source:** [Polkadot Treasury Lost $1.38 Million After XCM Patch Missed Production](https://thedefiant.io/news/hacks/polkadot-treasury-lost-1-38-million-after-xcm-patch-missed-production) — thedefiant.io

## Key points

- The Polkadot treasury incurred a $1.38 million loss after a planned XCM patch was missed during production deployment.
- The unapplied patch distorted automated pricing mechanisms across the DOT/dotUSD liquidity pool.
- A subsequent network upgrade repaired dotUSD supply accounting without altering the account balances of holders.

## Editorial remark

- **Context:** Cross-Consensus Messaging (XCM) handles communication between parachains and the Polkadot relay chain, making missed code deployments prone to execution inconsistencies.
- **Impact:** The Polkadot treasury absorbed a $1.38 million deficit from the pricing distortion, though dotUSD user account balances were preserved during the remediation.
- **Watch:** Monitoring official Polkadot governance discussions for post-mortem reviews and further protocol deployment verification procedures.

The Polkadot treasury lost $1.38 million following an incident where an intended Cross-Consensus Messaging (XCM) patch failed to make it into production [1]. The omitted update created a vulnerability that distorted liquidity pool pricing between $DOT and dotUSD [1].

According to Polkadot governance reporting, the defect specifically disrupted pricing mechanisms across the DOT/dotUSD trading pair [1]. While the price distortion enabled the extraction of $1.38 million from treasury funds, a subsequent network upgrade repaired the dotUSD stablecoin supply accounting system [1]. Network developers implemented the fix without altering the underlying token balances held by asset owners [1].

## Impact on Ecosystem Accounting

Cross-chain communication infrastructure remains a frequent vector for protocol disruptions across decentralized finance [1]. While broader sector analyses such as the [Hacken Q3 2026 security report](https://basisdesk.news/news/hacken-q3-2026-security-report-crypto-exploits) show hundreds of millions lost to protocol vulnerabilities, implementation gaps during production deployments present unique operational hurdles for modular networks [1].

At the time of writing, Polkadot's native token $DOT traded at $0.9860, up 5.3% over the prior 24 hours. The incident left dotUSD user balances intact following the deployment of the corrective accounting patch [1]. Polkadot governance documents did not detail additional steps following the deployment of the supply correction [1].

## Sources

1. [Polkadot Treasury Lost $1.38 Million After XCM Patch Missed Production](https://thedefiant.io/news/hacks/polkadot-treasury-lost-1-38-million-after-xcm-patch-missed-production) — thedefiant.io, 2026-11-04

---
Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai