Alephium TokenBridge Breach Exposes Vulnerability in Cross-Chain Plumbing

Alephium's TokenBridge was breached in a seven-minute attack that saw around $815,000 drained from the network. The attackers exploited an off-chain backend flaw to mint 13.76 million unbacked wrapped ALPH tokens, far exceeding the bridge's prior wrapped supply.

The breach occurred when attackers pushed fabricated transfer approvals through the TokenBridge on both Ethereum and BNB Chain, draining reserves and minting fresh tokens. On Ethereum, the thief took around $200,967 in Tether (USDT), $17,594 in USD Coin (USDC), and smaller amounts of Wrapped Ether and Wrapped Bitcoin.

Alephium initially blamed stolen guardian keys for the breach but later revealed that an off-chain bug was responsible. The project runs a private fork of the Wormhole messaging system with only four signers, leaving the possibility that other bridges built on similar code may be vulnerable to the same flaw.