Polkadot lost $1.38 million due to the XCM vulnerability because the fix was not deployed in time.

From October 24 to 26, an XCM executor vulnerability was exploited on Polkadot Asset Hub, causing pricing distortions in the DOT/dotUSD pool and creating arbitrage opportunities, resulting in a loss of approximately $1.381 million in DOT value. Polkadot Treasury, the sole liquidity provider for the pool, suffered no user fund losses. The fix for this vulnerability was completed through a bug bounty program in June, but it was not deployed to the mainnet version in a timely manner. On October 20, the reporter publicly mentioned the fix on a forum, which may have provided clues to attackers.