Alephium's Ethereum TokenBridge Exploited; About $8.15 Million Drained

Blockaid reported on X that Alephium's TokenBridge cross-chain bridge on Ethereum was compromised. The attacker reportedly seized three of four Guardian keys, forged VAA (Verified Authorization Messages), and executed the exploit in roughly seven minutes, siphoning about $8.15 million. During the incident, 13.76 million wrapped ALPH (Wrapped ALPH) were minted without backing—more than 100% of the pre-attack circulating supply—while assets including USDT, USDC, WBTC, and WETH were unlocked and moved out of the custody pool. As of now, the attacker's address is said to still hold roughly $8.15 million in stolen funds along with 13.76 million unbacked wrapped ALPH tokens. The largest abnormal transaction was the out-of-thin-air mint of 13.76 million wrapped ALPH.