Alephium TokenBridge Exploited: $815,000 Drained From Ethereum Cross-Chain Bridge

Odaily Planet Daily reported that security firm Blockaid said on X that Alephium's TokenBridge cross-chain bridge on Ethereum was attacked. The attacker reportedly gained control of three of the four Guardian keys, forged VAA (Verified Authorization Messages), and executed the exploit in about seven minutes, stealing roughly $815,000. Blockaid said the attacker minted 13.76 million Wrapped ALPH without backing, more than 100% of the token's pre-attack circulating supply, then unlocked and withdrew assets including USDT, USDC, WBTC, and WETH from the custodial pool. According to Blockaid, the attacker's address still holds about $8.15 million in stolen assets along with 13.76 million unbacked Wrapped ALPH. The largest abnormal transaction was the minting of 13.76 million Wrapped ALPH from nothing.