Polkadot loses $1.38M after hacker exploits flaw fixed four months earlier

The attacker used its own relayer before the XCM fix, and a later upgrade corrected supply without changing balances.