Alephium TokenBridge Breached for $815K in Seven Minutes
Alephium's TokenBridge was breached on May 30, allowing attackers to drain approximately $815,000 in about seven minutes. The attack occurred across two chains - Ethereum and BNB Chain - with the attacker minting 13.76 million unbacked wrapped ALPH tokens.
The attackers pushed forged messages through the bridge's backend, draining reserves and minting fresh tokens on both chains. On Ethereum, they took $200,967 in Tether (USDT), $17,594 in USD Coin (USDC), and smaller amounts of Wrapped Ether and Wrapped Bitcoin. On BNB Chain, they took $36,750 in USDT and $24.386 in Wrapped BNB.
Alephium initially blamed stolen guardian keys for the breach but later revealed that an off-chain backend flaw was the actual cause. The project's private fork of the Wormhole messaging system only has four signers, leaving room for similar flaws to exist in other bridges built on similar code.