Svmuu reported that Blockaid disclosed on the X platform that the Alephium TokenBridge Ethereum cross-chain bridge has been attacked. The attacker gained control of 3 out of 4 Guardian keys, forged a VAA (Verified Action Approval), and completed the attack in approximately 7 minutes, stealing a total of about $815,000 in assets.
During the attack, the attacker minted 13.76 million Wrapped ALPH out of thin air, exceeding 100% of the circulating supply before the attack. At the same time, they unlocked and transferred out assets such as USDT, USDC, WBTC, and WETH from the custody pool. Currently, the attacker's address still holds approximately $815,000 in stolen assets along with 13.76 million unbacked Wrapped ALPH. The largest anomalous transaction was the minting of 13.76 million Wrapped ALPH from nothing.