TechFlow reports that on May 30, Blockaid disclosed on X that the Alephium TokenBridge Ethereum cross-chain bridge was attacked. The attacker compromised three of the four Guardian private keys, forged a VAA (Verified Action Approval) message, and executed the attack within approximately seven minutes, stealing roughly $815,000 worth of assets.
During the attack, the attacker minted 13.76 million Wrapped ALPH tokens out of thin air—exceeding the pre-attack circulating supply by over 100%—and simultaneously unlocked and withdrew assets including USDT, USDC, WBTC, and WETH from the custody pool. As of now, the attacker’s address still holds approximately $815,000 in stolen assets and 13.76 million uncollateralized Wrapped ALPH tokens, with the largest anomalous transaction being the out-of-thin-air minting of 13.76 million Wrapped ALPH tokens.
