Alephium TokenBridge — Off-Chain Backend Vulnerability Enables Forged VAAs

Timeline: May 30, 2026 02:36:23 UTC — Attacker purchases 485.19 wALPH on Ethereum via Uniswap, spending 0.01 ETH. Immediately approves wALPH allowance for TokenBridge and bridges full amount to Alephium, receiving 485.19 native ALPH. May 30, 2026 03:52–06:24 UTC — Attacker forwards ALPH to contract deployer wallet across three transactions (5 ALPH, 150 ALPH, 130 ALPH). May 30, 2026 06:30:47 UTC — Deployer wallet deploys fake-event contract (24ZjqcvV8vVCn29zd1TThqAtaS8pMvJ4Co1MK5zncPcAB) with 0.1 ALPH. Contract contains a single function executing LOG7 to emit fake VAA payloads. May 30, 2026 07:00–09:00 UTC — Attacker disrupts bridge node P2P connectivity via eclipse-style attack, forcing the backend onto its fallback validation path where the vulnerable logic exists. May 30, 2026 09:16:59–09:18:03 UTC — Main drain in 64 seconds across 7 transactions: Ethereum: 200,967 USDT (09:16:59) | 0.33531 WBTC (09:17:23) | 17,594 USDC (09:17:35) | 5.18 WETH (09:17:47) | 13,757,076 wALPH minted (09:17:59). BSC: 36,750 USDT (09:18:02) | 24.386 WBNB (09:18:03). May 30, 2026 — Shortly after drain: @Blockaid_ detects exploit (first public alert). SEAL 911 mobilized. Bridge shut down by Alephium team. Official statement issued: 'The exploit was NOT caused by a compromise of the guardian keys... It was caused by an offchain vulnerability in the bridge backend that could be triggered in specific edge cases.' Alephium advises LPs on Uniswap and PancakeSwap to withdraw liquidity. May 30, 2026 — Liquidation: Stablecoins and WBTC swapped to WETH via Uniswap X. BSC funds bridged to Ethereum via deBridge. ETH consolidated. 400,000 wALPH dumped into Uniswap V3 pool. 50 ETH deposited into Tornado Cash. June 1, 2026 — Alephium publishes bridge update: recovery path for legitimate wALPH holders identified. All eligible holders identified via snapshot. Incident report submitted to Switzerland NCSC. Law enforcement coordination initiated. June 2, 2026 14:49:35 UTC — Bridge guardians execute authorized governance recovery procedure at block 25,230,400: burn of 13,257,077.37 unbacked wALPH held in attacker wallets (96.4% of total minted). 500,000 wALPH had already been sold and exited the response window. June 3, 2026 — Alephium confirms Alephium will supply native ALPH to back the 500,000 wALPH already sold. Bridge relaunch considered as fastest recovery path. Full postmortem promised. June 2, 2026 — Alephium publishes full on-chain report at alephium.org/news/post/the-alephium-bridge-exploit-on-chain-report/. Note on actual losses: the '$815K' figure reflects notional wALPH mint at pre-crash prices. Actual backed collateral stolen: ~$305K. 96.4% of unbacked wALPH burned.