Alephium Bridge 2026 forged-message exploit
An attacker deployed a fake-event contract on Alephium that emitted forged Wormhole-format messages. The bridge guardian path signed the resulting VAAs, which were redeemed on Ethereum and BNB Chain to release real collateral and mint unbacked wALPH. Alephium later burned 13,257,077.37295 unbacked wALPH, while 500,000 wALPH had escaped before the pause.
Incident facts
- Incident title
- Alephium Bridge 2026 forged-message exploit
- Bridge
- Alephium Bridge
- Incident date
- 2026-05-30
- Incident type
- Exploit
- Major incident
- Yes
- Affected chains
- Ethereum, BNB Chain, Unknown
- Affected assets
- USDT, USDC, WETH, WBTC, WBNB, Unknown
- Attack category
- Message Verification Failure
- Reported loss
- about $815,000
- Amount confidence
- Medium
- Loss amount basis
- Mixed Sources
- Recovery
- None
- Reimbursement
- Unknown
- Restart
- Paused
- Current outcome
- Paused Long Term
- Postmortem
- Unclear
- Resolution
- Unresolved
- Last reviewed
- 2026-09-01
- Last verified
- 2026-09-01
Amount and valuation
Independent technical reporting estimates approximately $815,000 of bridge collateral drained; Alephium’s first-party report separately enumerates the forged-message flow and unbacked wALPH mint/burn quantities.
The USD total is secondary corroboration. The authorized burn of unbacked wALPH is not subtracted from the real-collateral loss figure.
bridge collateral drainedabout $815,000
Secondary technical valuation; first-party report is authoritative for mechanics and token quantities.
Why this remains unresolved
- Recovery of the drained real collateral is not established.
- Completed reimbursement is not established.
- A dated bridge reopening is not established.
Timeline events
Alephium TokenBridge forged-message exploit2026-05-30
Forged Wormhole-format events produced guardian-signed VAAs that were redeemed against real bridge collateral and used to mint unbacked wALPH.
First-party Alephium report establishes the forged-event/VAA sequence; USD loss is kept in the incident record.
Alephium burns most unbacked wALPH2026-06-02
Alephium reported an authorized burn of 13,257,077.37295 unbacked wALPH, 96.4% of the forged-mint total; 500,000 wALPH had escaped before the pause.
Authorized cleanup of unbacked supply; explicitly not classified as recovery of the real collateral drained from bridge custody.
Evidence records
- The Alephium Bridge Exploit: On-Chain ReportAlephium · Tier 1 · High reliability · primary · 2026-06-02Claim scope: Incident Case
First-party on-chain report establishing the May 30 forged-event/VAA sequence, real-collateral redemption, unbacked wALPH mint, and June 2 authorized burn. The publisher explicitly says this report is not the full postmortem.
- The Alephium TokenBridge Exploit ($815K) — Lemma Critical Brief No.023Lemma Critical · Tier 2 · Medium reliability · secondary · 2026-06-05Claim scope: Amount
Independent technical corroboration for the approximately $815K collateral-loss estimate and forged-message mechanism. First-party Alephium evidence remains authoritative where claims differ.
- The Alephium Bridge Exploit: On-Chain ReportAlephium · Tier 1 · High reliability · primary · 2026-06-02Claim scope: Incident Case
First-party Alephium report linked directly to the exploit event; the separate evidence record remains linked to the remediation event.
Source tiers describe evidence authority, not certainty for every claim. Tier 1 is the strongest source class; Tier 2 and Tier 3 provide progressively more secondary or supporting context. Source notes define what each record actually supports.
Known unknowns
- Alephium explicitly states that its June 2 on-chain report is not the full postmortem.
- The final recovery and reimbursement outcome remains unresolved.
Help maintain incident aftermath records
Support recovery, reimbursement, restart, migration, shutdown, evidence, and correction checks.
Report a correction
Report missing evidence, incorrect dates, outcome changes, recovery details, reimbursement status, or broken links. GitHub Issues are preferred for structured review; the Google Form is available if you do not use GitHub.