[Polkadot Suffers $1.38 Million Loss Due to XCM Vulnerability in October; Code Fixed in June but Not Deployed in Time] A Polkadot forum recap of the XCM incident reveals that from October 24th to 26th, an XCM executor vulnerability was exploited on the Polkadot Asset Hub. Attackers reduced the issuance of dotUSD without altering account balances, causing DOT/dotUSD pool pricing distortion and creating arbitrage opportunities, resulting in an estimated loss of approximately $1.381 million in DOT value. The Polkadot Treasury, the sole liquidity provider in the pool, suffered no user losses. The recap points out that the vulnerability was reported through a bug bounty program in June and fixed in the codebase, but the fix was not deployed to the affected mainnet version in a timely manner. On October 20th, the reporter publicly mentioned the fix on the forum, potentially providing clues to the attackers.