Alephium TokenBridge Attacked, Hackers Steal $815K in 7 Minutes After Compromising 3 Guardian Keys

According to Blockaid, the Alephium TokenBridge Ethereum cross-chain bridge was attacked, with hackers stealing approximately $815,000 in assets within 7 minutes. The attackers compromised 3 of 4 Guardian keys to forge VAA (Verifiable Action Approval) messages and execute the exploit.

During the attack, the hackers minted 16 million wrapped ALPH tokens from nothing—exceeding pre-attack circulating supply by over 100%—and unlocked multiple assets from the custody pool including USDT, USDC, WBTC, and WETH. The attacker addresses still hold all $815K in stolen funds and the 16 million unsecured wrapped ALPH tokens.