Polkadot lost $1.38 million after hacker exploited flaw fixed four months earlier

The attacker resumed operations on October 26 before an XCM fix; a later upgrade corrected supply without changing balances.