Alephium

Wormhole

Read

Coin

A cross-chain bridge linking the Alephium<a href="https://yellow.com/asset/alph" rel="noopener noreferrer nofollow">(ALPH)</a> network to Ethereum<a href="https://yellow.com/asset/eth" rel="noopener noreferrer nofollow">(ETH)</a> and <a href="https://yellow.com/asset/bnb" rel="noopener noreferrer nofollow">BNB</a> Chain lost roughly $815,000 in about seven minutes after attackers forced forged messages through its backend.
<blockquote>
 <h2 id="key-points">Key Points:</h2>
 <ul>
 <li>Attackers drained about $815,000 from Alephium's TokenBridge across two chains in roughly seven minutes.</li>
 <li>They minted 13.76 million unbacked wrapped ALPH, more than the bridge's entire prior wrapped supply.</li>
 <li>Alephium blames an off-chain backend flaw, not stolen guardian keys, and has pledged to repay affected users.</li>
 </ul>
</blockquote>
<h2 id="alephium-tokenbridge-drained-fast">Alephium TokenBridge Drained Fast</h2>
Security firm Blockaid first <a href="https://beincrypto.com/alephium-bridge-exploit-forged-messages/" rel="noopener noreferrer nofollow">detected</a> the attack on May 30, with the volunteer response unit SEAL 911 quickly joining the investigation. The attacker pushed fabricated transfer approvals through the TokenBridge on both Ethereum and BNB Chain, drained the reserves, and minted fresh tokens.
The whole sequence took about seven minutes.
On Ethereum, the thief <a href="https://nulltx.com/alephium-bridge-hacked-for-815000-in-7-minutes-as-compromised-guardian-keys-enable-forged-token-transfers/" rel="noopener noreferrer nofollow">took</a> 200,967 Tether<a href="https://yellow.com/asset/usdt" rel="noopener noreferrer nofollow">(USDT)</a>, 17,594 USD Coin<a href="https://yellow.com/asset/usdc" rel="noopener noreferrer nofollow">(USDC)</a>, and smaller amounts of Wrapped Ether and Wrapped Bitcoin, while the BNB Chain side gave up 36,750 USDT and 24.386 Wrapped BNB. The same wallet also <a href="https://cryptonews.net/news/security/32942218/" rel="noopener noreferrer nofollow">minted</a> 13.76 million wrapped ALPH with no real ALPH locked behind it.
That haul ran past the bridge's entire prior wrapped supply, leaving the attacker holding coins conjured from nothing.
Also Read:<a href="https://yellow.com/news/cardano-tops-major-chains-stablecoin-61" rel="noopener noreferrer nofollow">Cardano Tops Every Major Chain In Stablecoin Growth, Up 61% In A Week</a>
<h2 id="off-chain-flaw-not-stolen-keys">Off-Chain Flaw, Not Stolen Keys</h2>
Early accounts pinned the breach on three of four compromised guardian keys, but Alephium later <a href="https://www.cryptotimes.io/2026/05/30/alephium-reveals-cause-of-815k-bridge-exploit-promises-compensation/" rel="noopener noreferrer nofollow">said</a> the real cause was an off-chain bug in the bridge backend, and Blockaid softened its first read to match. The project runs a private fork of the Wormhole messaging system with only four signers, so the same flaw could lurk in other bridges built on similar code.
The change in cause reframes the entire incident.
<h2 id="alephium-pledges-to-repay-users">Alephium Pledges To Repay Users</h2>
Alephium has <a href="https://www.cryptotimes.io/2026/05/30/alephium-bridge-exploited-for-815k-13-76m-unbacked-alph-minted/" rel="noopener noreferrer nofollow">halted</a> the bridge, urged holders to pull liquidity from ALPH pools, and promised a recovery path for users whose coins stayed locked inside. With the bridge offline, the attacker cannot push the unbacked wrapped ALPH back through it, and the stolen funds sat unmoved in the wallet at disclosure. The team says it is weighing every option to make affected users whole, with a full postmortem due this week.
The breach extends a punishing stretch for cross-chain bridges, the plumbing that ferries assets between separate blockchains.
A recent hit on the <a href="https://yellow.com/news/verus-ethereum-bridge-11m-attack" rel="noopener noreferrer nofollow">Verus-Ethereum bridge drained about $11.58 million</a>, and the forged-message tactic echoes Wormhole's loss of more than $320 million years earlier. One tally <a href="https://www.cryptotimes.io/2026/05/31/bleak-may-2026-52m-stolen-20b-tvl-melt-and-defis-unsafe-reckoning/" rel="noopener noreferrer nofollow">pegged</a> May at over $52 million in stolen crypto across the sector.
Read Next:<a href="https://yellow.com/news/eth-loses-last-floor-drop-1800" rel="noopener noreferrer nofollow">ETH Loses Its Last Floor And Stares Down A Drop Toward $1,800</a>

Alephium Says Off-Chain Flaw, Not Stolen Keys, Opened $815K Breach

Table of Contents

Yellow News

Other articles published on Jun 1, 2026

Bithumb Adjusts SLX Listing Schedule, Delays KRW Trading by One Hour

SuperEx Educational Series: Understanding Zero-Knowledge Circuit Design

RLUSD Explained: Ripple's Dollar Stablecoin and Its Role in the XRP Ecosystem

How Do You Get Listed on Aster? Listings Go Permissionless

Cardano's EUTXO Model Explained & How It Differs From Ethereum's Account Model

Securing Billions: What is Chainlink's CCIP?

Join our free newsletter for daily crypto updates!