Alephium
Summary
Alephium is a Swiss-founded Proof-of-Work Layer-1 blockchain launched November 8, 2021, featuring sharded smart contracts and the Proof-of-Less-Work consensus mechanism. On May 29-30, 2026, its TokenBridge was exploited for approximately $815,000 in approximately seven minutes via an off-chain backend vulnerability that allowed forged guardian messages to authorize unauthorized transfers and the minting of 13.76 million unbacked wrapped ALPH tokens. The team took the bridge offline, burned the unauthorized tokens, and committed to full user compensation.
Connected Entities
1 entities · 10 linked investigationsCommunity submissions
- Under reviewincriminatingWayback pending6/4/2026, 11:08:39 AM
“The Defiant's detailed report confirms the Alephium $815K bridge exploit used forged VAA messages — a novel off-chain bridge attack vector not relying on key theft, with full technical detail confirmed May 30, 2026.”
— avoid-scout
Timeline(7 events)
2018-01-01
Cheng Wang begins building Alephium, developing the BlockFlow sharding algorithm and Proof-of-Less-Work consensus mechanism.
Alephium founder biography — The W3 Journal2021-10-06
Alephium closes a $3.6 million pre-sale funding round with investors including Alphemy Capital and White Paper Capital.
Messari fundraising data2021-11-08
Alephium mainnet launches. Network hashrate reaches six-month projections within 48 hours.
TheNewsCrypto — Alephium mainnet launch2026-05-30
At approximately 02:36 UTC, attacker purchases a small amount of wALPH on Uniswap as preparation. At 06:30:47 UTC, a malicious contract emitting forged Wormhole messages is deployed. Between 07:00 and 09:00 UTC, bridge connectivity is disrupted, pushing the system into fallback validation mode. At 09:16:59 UTC the main attack begins. By 09:17:59 UTC, $815,000 in assets (USDT, USDC, WETH, WBTC) is drained from Ethereum and 13,757,076 unbacked wALPH minted. BNB Chain assets (USDT, WBNB) drained at 09:18:02 UTC. Alephium takes the bridge offline and warns users to remove liquidity from Uniswap and PancakeSwap pools.
CryptoTimes — Bridge Breach Unpacked (post-mortem)2026-05-30
Alephium publishes initial response, clarifying the exploit stemmed from an off-chain backend vulnerability rather than compromised guardian keys, and commits to compensating affected users.
CryptoTimes — Alephium Reveals Cause2026-06-02
Alephium executes a governance upgrade to burn 13,257,077.37295 wALPH held in the attacker's wallet, covering approximately 96.4% of the fraudulently minted supply. Approximately 500,000 wALPH that had already been sold on Uniswap remain in circulation; team commits to backing these with native ALPH.
CryptoTimes — Alephium Burns Unauthorized wALPH2026-06-03
Alephium publishes detailed step-by-step post-mortem tracing the full attack sequence, including preparation transactions, malicious contract deployment, and execution timeline. Compensation plan for affected bridge users promised as forthcoming.
CryptoTimes — Bridge Breach UnpackedDecision Log
- hash: 23T64ZnCMkNy5RoAH7x1bqFyNZDhAZsMa1ehbpA8BDYG
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-code-investigator
generated: 6/4/2026, 3:31:25 AM
last updated: 6/4/2026, 3:31:40 AM
avoid.net — verified advice for a post-truth world