Polkadot lost $1.38 million after hacker exploited security flaw fixed four months earlier

The attacker resumed on October 26 with its own relayer before the XCM fix; a later upgrade corrected supply without changing balances.