A cross-chain bridge linking the Alephium (ALPH) network to Ethereum (ETH) and BNB Chain lost roughly $815,000 in about seven minutes after attackers forced forged messages through its backend.
Key Points:
- Attackers drained about $815,000 from Alephium's TokenBridge across two chains in roughly seven minutes.
- They minted 13.76 million unbacked wrapped ALPH, more than the bridge's entire prior wrapped supply.
- Alephium blames an off-chain backend flaw, not stolen guardian keys, and has pledged to repay affected users.
Alephium TokenBridge Drained Fast
Security firm Blockaid first detected the attack on May 30, with the volunteer response unit SEAL 911 quickly joining the investigation. The attacker pushed fabricated transfer approvals through the TokenBridge on both Ethereum and BNB Chain, drained the reserves, and minted fresh tokens.
The whole sequence took about seven minutes.
On Ethereum, the thief took 200,967 Tether (USDT), 17,594 USD Coin (USDC), and smaller amounts of Wrapped Ether and Wrapped Bitcoin, while the BNB Chain side gave up 36,750 USDT and 24.386 Wrapped BNB. The same wallet also minted 13.76 million wrapped ALPH with no real ALPH locked behind it.
That haul ran past the bridge's entire prior wrapped supply, leaving the attacker holding coins conjured from nothing.
Also Read: Cardano Tops Every Major Chain In Stablecoin Growth, Up 61% In A Week
Off-Chain Flaw, Not Stolen Keys
Early accounts pinned the breach on three of four compromised guardian keys, but Alephium later said the real cause was an off-chain bug in the bridge backend, and Blockaid softened its first read to match. The project runs a private fork of the Wormhole messaging system with only four signers, so the same flaw could lurk in other bridges built on similar code.
The change in cause reframes the entire incident.
Alephium Pledges To Repay Users
Alephium has halted the bridge, urged holders to pull liquidity from ALPH pools, and promised a recovery path for users whose coins stayed locked inside. With the bridge offline, the attacker cannot push the unbacked wrapped ALPH back through it, and the stolen funds sat unmoved in the wallet at disclosure. The team says it is weighing every option to make affected users whole, with a full postmortem due this week.
The breach extends a punishing stretch for cross-chain bridges, the plumbing that ferries assets between separate blockchains.
A recent hit on the Verus-Ethereum bridge drained about $11.58 million, and the forged-message tactic echoes Wormhole's loss of more than $320 million years earlier. One tally pegged May at over $52 million in stolen crypto across the sector.
Read Next: ETH Loses Its Last Floor And Stares Down A Drop Toward $1,800