Alephium TokenBridge Hit by $815K Breach via Off-Chain Flaw

Alephium's TokenBridge was breached, resulting in the loss of around $815,000 in about seven minutes. Attackers exploited an off-chain backend flaw to mint 13.76 million unbacked wrapped ALPH tokens.

The attack occurred on May 30, when security firm Blockaid first detected it. The attackers pushed fabricated transfer approvals through the TokenBridge on both Ethereum and BNB Chain, draining the reserves and minting fresh tokens.

Alephium initially suspected that three of four compromised guardian keys were to blame for the breach, but later revealed that an off-chain bug was the actual cause. This change in explanation reframes the entire incident, as it highlights a potential flaw in other bridges built on similar code.