Alephium TokenBridge Drained $815K in 7 Minutes by Flawed Backend Code

Alephium's TokenBridge was drained of approximately $815,000 in a matter of seven minutes on May 30. The attackers exploited an off-chain backend flaw to mint 13.76 million unbacked wrapped ALPH tokens, exceeding the bridge's entire prior wrapped supply.

The breach occurred when fabricated transfer approvals were pushed through the TokenBridge on both Ethereum and BNB Chain, draining reserves and allowing the attacker to mint fresh tokens with no real ALPH locked behind them.

Alephium initially blamed compromised guardian keys for the breach but later attributed it to an off-chain bug in the bridge backend. The project has halted the bridge and urged holders to pull liquidity from ALPH pools, promising a recovery path for users whose coins stayed locked inside.