Alephium Bridge Loses $815K to Forged Guardian Messages, Not Stolen Keys

Crypto Insight Summary: Alephium's Wormhole-fork TokenBridge lost approximately $815,000 across Ethereum and BNB Chain on Friday after an attacker exploited an off-chain backend vulnerability to push forged messages past the network's four-guardian system, completing the drain in about seven minutes. Initial reports from Blockaid, which first detected the exploit and alerted the SEAL 911 emergency-response unit, incorrectly blamed compromised guardian keys; both Blockaid and Alephium have since revised that assessment, ruling out a smart-contract bug and a key compromise. The attackers drained 200,967 USDT, 17,594 USDC, 5.18 WETH, and 0.335 WBTC on Ethereum, plus 36,750 USDT and 24.386 WBNB on BNB Chain, and minted 13.76 million unbacked wrapped ALPH on Ethereum. The root issue was a software-layer flaw between the on-chain contracts and the off-chain process feeding the guardians, causing the guardians to sign valid signatures over invalid data, with six signed approvals sufficient to drain the bridge. Alephium's setup of four guardians with a three-signature quorum is far smaller than Wormhole mainnet's 19 guardians and 13-signature threshold, making it mathematically more vulnerable to forged-message exploits. The team has shut the bridge down, stated that ALPH locked in the bridge is recoverable, and urged ALPH holders on Ethereum and BNB Chain to immediately pull liquidity from Crypto Insight Analysis: Direction: Bearish ALPH Impact: Minor Impact Horizon: Short-term (1-3 days) Reasoning: Bridge exploit undermines trust and liquidity, but recoverable funds limit long-term damage.