Alephium has warned liquidity providers to withdraw from ALPH pools after an exploit drained about $815,000 from its Token Bridge on Ethereum and BNB Chain.
The attacker minted 13.76 million wrapped ALPH through unauthorized bridge activity, while several major assets also left custody contracts. The team has shut down the bridge and said recovery work is now the main priority.
Hackers Drain Multiple Bridge Assets
The incident affected USDT, USDC, WETH, WBTC, and WBNB across Ethereum and BNB Chain. Early security reporting from Blockaid said the attacker had gained control over three of four guardian keys and used forged Verified Action Approvals to authorize transfers.
Blockaid said the operation lasted about seven minutes. During that period, the attacker created more wrapped ALPH than the previous wrapped supply and unlocked other assets from bridge custody.
On-chain analyst Specter reported that both Ethereum and BNB Chain bridge contracts were hit. The analyst also said stolen funds moved from BNB Chain to Ethereum, and part of the proceeds later entered Tornado Cash.
Alephium Disputes Guardian Key Report
Alephium later challenged the early assessment and said the exploit did not come from a guardian key compromise. The project said the incident came from an off-chain vulnerability in the bridge backend that appeared under specific edge cases.
The team also gave a breakdown of drained funds. It said the attacker took 200,967 USDT, 17,594 USDC, 5.18 WETH, and 0.335 WBTC from Ethereum. On BNB Chain, the losses included 36,750 USDT and 24.386 WBNB.
Alephium said its technical team is focused on remediation, recovery, and further communication. The project also promised more updates in the coming week as it works through the damage.
Liquidity Providers Told To Exit Pools
Alephium urged users not to add liquidity to ALPH pools on Uniswap or PancakeSwap. It also asked existing liquidity providers to withdraw funds and avoid swaps against affected pools.
The warning came because the attacker cannot redeem the unauthorized wrapped ALPH through the bridge while it remains offline. However, more liquidity or trading activity could help the attacker turn those tokens into value.
ALPH recently traded at $0.037, while its market value stood above $5 million. DefiLlama data showed about $756,000 in total value locked across Alephium DeFi protocols and more than $308,000 in bridged value.
The attack adds to a difficult month for cross-chain bridges. Gravity Bridge lost $5.4 million on May 30, Verus-Ethereum lost about $11.5 million on May 18, and THORChain faced a $10 million coordinated attack on May 15. These incidents have renewed scrutiny on bridge security as attackers continue targeting systems that move assets across separate chains and networks.
