Alephium Token Bridge Drained for $815K in Seven-Minute Exploit

• Attackers forged transactions to mint 13.76 million wrapped ALPH tokens, draining $815,000.
• Alephium cited a backend vulnerability, urging immediate liquidity withdrawal.

On May 31, 2026, Cryptopolitan reported that attackers exploited Alephium’s Token Bridge on Ethereum, draining $815,000 and minting 13.76 million wrapped ALPH tokens—far exceeding the existing supply—by forging transactions in a rapid seven-minute window. This exploit enabled the attacker to move funds across chains and launder assets through Ethereum and Tornado Cash.

The breach occurred amid a spate of cross-chain protocol attacks. According to DefiLlama, bridge hacks resulted in over $326 million in losses for 2026 as of mid-May, with Gravity Bridge suffering a $5.4 million exploit and Verus-Ethereum losing $11.5 million earlier that month. The Alephium attack further underscored persistent vulnerabilities in bridge infrastructure.

Initial analysis from security firm Blockaid suggested the attacker compromised three guardian keys and forged Verified Action Approvals (VAAs), unlocking USDT, USDC, WBTC, and WETH. Alephium disputed this, later confirming that a vulnerability in the bridge’s offchain backend—not a guardian key compromise—enabled the attack.

Alephium promptly shut down the affected bridge and urged all liquidity providers to withdraw funds from ALPH pools on Ethereum and BNB Chain, warning that continued liquidity or trading would facilitate profits for the attacker via unauthorized tokens.

As of May 31, 2026, 12:08 UTC, Tether USDt (USDT) is trading at $0.999 with a -0.004% 24-hour volume change. BNB is trading at $721.528, up 7.219%. USDC is trading at $1, up 0.002%.