Alephium’s TokenBridge has become the latest cross-chain system to face a fast-moving exploit, after attackers reportedly drained about $815,000 from the Ethereum side of the bridge in roughly seven minutes.
The early security breakdown points to a guardian-signature failure rather than a normal user-side wallet drain. The attacker allegedly used three compromised guardian keys from a four-guardian setup to sign forged Verifiable Action Approvals, or VAAs, allowing the Ethereum bridge contracts to process messages that did not reflect legitimate cross-chain activity.
For users tracking the damage, the attack path is important. A forged VAA attack does not need to trick ordinary users into signing malicious approvals. It targets the bridge’s message-verification layer, the part that tells one chain whether assets were properly locked, burned, minted, or released on another chain.
Wrapped ALPH Supply Shock Hits The Bridge
The reported impact went beyond a simple token transfer. About 13.76 million wrapped ALPH were minted on Ethereum, a figure that was larger than the prior wrapped ALPH supply shown for the Ethereum contract. The bridge’s Ethereum-side ALPH token contract previously displayed a maximum total supply of about 12.85 million ALPH, which makes the extra mint especially damaging for market confidence.
The attacker also reportedly unlocked custody-held USDT, USDC, WBTC, and WETH. Those assets matter because bridge users treat wrapped assets as claims backed by locked tokens elsewhere. When a forged message can mint wrapped supply or release custody assets, the trust model breaks at the infrastructure layer, not only at the trading layer.
Alephium’s bridge design uses guardians to monitor connected chains, verify cross-chain events, and combine signatures into VAAs before the destination contract releases or mints assets. That architecture is common across bridge systems, but the Alephium incident shows why guardian-key security remains one of the highest-risk parts of cross-chain infrastructure.
Bridge Security Pressure Keeps Building
The exploit lands days after another bridge-focused incident shook the market. Gravity Bridge recently faced a suspected $5.4 million drain tied to a possible contract-key or signing-path compromise, keeping attention on the way bridges authorize movement between ecosystems.
The Alephium case is smaller by dollar value, but its mechanics are serious because the reported mint exceeded the old wrapped ALPH supply and directly touched custody assets. For DeFi users, that kind of failure can create immediate uncertainty around whether wrapped tokens remain fully backed, whether liquidity pools can price the asset cleanly, and whether centralized exchanges or DEXs need to pause related markets.
The case also arrives during a separate custody-control debate after a Circle freeze locked Zama cUSDC funds inside an Ethereum contract. Both stories point to the same market reality: wrapped assets, bridge claims, and issuer controls can become risk points when infrastructure permissions fail or are used unexpectedly.
Postmortem Now Becomes The Market Test
A full technical postmortem will need to explain how three guardian keys were compromised, whether the attacker gained access through shared infrastructure, separate operators, deployment leakage, or another operational path. It will also need to clarify whether the forged mint can be neutralized, whether unlocked custody assets can be traced or recovered, and whether wrapped ALPH markets require a migration, pause, or contract-level remediation.
Until then, the most important risk signal is the bridge’s guardian threshold. A 3-of-4 setup leaves little room for independent key failure, and once that quorum is compromised, the bridge can accept fraudulent messages as valid. For Alephium, restoring confidence now depends on transparent recovery steps, updated guardian controls, and a clear accounting of which assets are still backed after the exploit.
