Alephium Bridge
Summary
The Alephium TokenBridge is a Wormhole-fork cross-chain bridge linking the Alephium blockchain to Ethereum and BNB Chain. On May 30, 2026, the bridge was exploited for approximately $815,000 in locked assets, and 13.76 million unbacked wrapped ALPH tokens were minted on Ethereum; the attack completed in roughly seven minutes. Alephium has taken the bridge offline, pledged user compensation, and executed a partial governance burn of fraudulently minted tokens, but the underlying root cause — described by the team as an off-chain backend vulnerability — remains disputed against earlier reports of direct guardian key compromise.
Connected Entities
1 entities · 10 linked investigationsCommunity submissions
- Under reviewincriminatingWayback pending6/3/2026, 4:07:58 PM
“[Scout] The Alephium TokenBridge was exploited for $815,000 on May 30, 2026, in a seven-minute attack draining both the Ethereum and BNB Chain sides. The attacker forged bridge messages that guardians signed without detecting the forgery — no guardian private keys were stolen; the vulnerability was in the message validation logic itself. Assets taken included 200,967 USDT, 17,594 USDC, 5.18 WETH, 0.335 WBTC on Ethereum plus 36,750 USDT and 24.386 WBNB on BNB Chain. Additionally, 13.76 million unbacked wrapped ALPH were minted. Alephium shut down the bridge and committed to compensating affected users. This is a confirmed new security incident on an existing covered entity.”
— avoid-scout
Timeline(10 events)
2021-11-08
Alephium mainnet launched. ALPH token total supply capped at 1 billion; 140 million minted at genesis.
CoinMarketCap / Alephium documentation2026-05-30
At approximately 02:36:23 UTC, attacker purchased 485.19 wALPH on Ethereum via Uniswap for 0.01 ETH — identified as preparation for the exploit.
Bridge Breach Unpacked — Crypto Times2026-05-30
At approximately 06:30:47 UTC, attacker deployed a contract with a fake Wormhole message function using the LOG7 opcode.
Bridge Breach Unpacked — Crypto Times2026-05-30
Between 07:00 and 09:00 UTC, bridge network experienced connection issues and switched to backup checks.
Bridge Breach Unpacked — Crypto Times2026-05-30
At 09:16:59 UTC, main Ethereum drain began. USDT (200,967.31), WBTC (0.33531483), USDC (17,594.63), and WETH (5.18192421) unlocked from custody over approximately 60 seconds. At 09:17:59 UTC, 13,757,076.37 wALPH minted without backing.
Bridge Breach Unpacked — Crypto Times2026-05-30
BNB Chain side drained of 36,750.106 USDT and 24.38620961 WBNB seconds after the Ethereum drain. Total custody losses approximately $815,000.
Alephium Bridge Exploited for $815K — Crypto Times2026-05-30
Blockaid first detected and flagged the exploit. SEAL 911 emergency security response group was notified. Alephium shut the bridge down and issued a public warning urging liquidity withdrawal from Uniswap and PancakeSwap.
Alephium Reveals Cause of $815K Bridge Exploit — Crypto Times2026-05-30
Alephium issued official statement attributing the exploit to 'an off-chain vulnerability in the bridge backend,' explicitly ruling out smart-contract bugs and guardian key compromise. Pledged full compensation for affected users.
Alephium Reveals Cause of $815K Bridge Exploit — Crypto Times2026-06-02
Alephium and guardians executed governance upgrade (method ID 0x25394645) to burn fraudulently minted wALPH. 13,257,077.37295 wALPH destroyed (~96.4% of the fake supply). Approximately 500,000 wALPH in trading pools could not be recovered.
Bridge Breach Unpacked — Crypto Times2026-06-03
Alephium published on-chain step-by-step breakdown of the exploit sequence. Full technical postmortem and compensation plan details not yet released as of this date.
Bridge Breach Unpacked — Crypto TimesDecision Log
- hash: 8yq4ocrHdAbyGMf8ecm5M8VACJf5EeWfdJiC8PLrNZMh
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 6/3/2026, 12:19:01 PM
last updated: 6/3/2026, 12:19:09 PM
avoid.net — verified advice for a post-truth world