On May 30, 2026, Alephium TokenBridge was exploited via off-chain backend flaw in guardian message verification. Attackers deployed fake contracts to forge VAAs, disrupted node connectivity to trigger fallback validation, and authorized transfers totaling $815K across Ethereum and BNB Chain, plus 13.76M unbacked ALPH minting.

Alephium TokenBridge was exploited. The attacker used a backend vulnerability in the bridge to forge messages, draining approximately $815K assets from Ethereum and BNB Chain within about 7 minutes, while minting a large amount of unbacked wrapped ALPH. The team quickly shut down the bridge, pledged to compensate users, and advised users to withdraw ALPH liquidity.