Polkadot loses $1.38 million to hacker exploiting flaw fixed four months earlier

A hacker exploited a security flaw in Polkadot's XCM system that had already been patched four months earlier, draining $1.38 million. The attacker resumed on October 26 using its own relayer before the fix was applied, and a later upgrade corrected supply without changing balances. The loss highlights execution risk around delayed upgrades, a negative signal for DOT holders even though the flaw itself was already known.