# Alephium Bridge Exploit: Wetin Happen True True — Postmortem

![](https://cdn.hashnode.com/uploads/covers/6926f4a7365f42f013759b58/f4cdf5fa-c35d-4c1d-bafa-0042e8884f77.png align="center")

### Summary

On 30 May 2026, person waka go carry out exploit for the Alephium Bridge. The moni wey him theif then come withdraw reach $305,000 worth of collateral from the Token Bridge contracts for Ethereum and BNB Chain. As the previous matter still dey happen, the theif come mint around 13.76 million unbacked wrapped ALPH (wALPH) for Ethereum. Alephium people come do quick shut down the bridge that same morning, and since that thing happen, the kurukere way wey the thief use do exploit don close kpata kpata.

Make we make one thing clear: The attacker no theif enter any guardian key, and him no hack any on-chain smart contract. Wetin the hacker do be say, him look well come see say a missing validation dey inside the bridge's off-chain re-observation process come use from there thief the moni. The theif also do something wey be like eclipse attack against the bridge full nodes. This one force traffic to use fallback path wey no too strong. Because of this kind move, the original guardians kukuma come sign the messages wey dey cryptographically valid but wey no dey actually authorized.

The road wey the theif use theif the moni don close kpata kpata and dem don do independent audit ontop am. Around 96.4% of the unbacked wALPH wey the their theif don burn on-chain. And all the better people assets don dey re-backed so that no genuine user go lose money. Alpehium people dey plan to relaunch the together with the guardians. This document combine together the on-chain report, the burn matter and the external audit report into one full talk of wetin happen.

### Impact

![](https://cdn.hashnode.com/uploads/covers/6926f4a7365f42f013759b58/e680ab7d-912e-4c60-83e2-3890559d2a76.png align="center")

The the wey the theif affect well well na the bridge infrastructure. Na about: • $305,000 collateral dem theif commot. 13.76 million wALPH wey no get backing don dey minted for Ethereum Blockchain. Na 96.4% of the unbacked wALPH dem don burn already. But the important thing be say: The Alephium blockchain gong or no dey affected.

### Root Cause

Wetin Happen True True? The Alephium Bridge architecture wey dem build dey based on the Wormhole design, but the kurukere code wey dem carry theif the moni dey inside Alephium's own watcher and re-observation infrastructure gon gor. So make we commot this one for road sef: Wormhole protocol no be the problem for here. Normally, na the guardians dey monitor events wey dey happen for the source blockchain through watcher software. Anytime wey the watcher see and come do well validate event, the guardian go sign one message wey dem dey call VAA.

Wetin the attacker see a weakness between the normal observation path and the fallback path. First, the attacker scatter the bridge own full node and him use an eclipse-style attack. Wetin e come mean be say the normal observation process been not fit come properly see or connect plenti transactions. As e come be, when the normal process come stop, the bridge come automatically use him own fallback re-observation path. Wetin the fallback path dey do be say him go come fetch events again for transactions wey done interact with the bridge but wey no properly connect from the full node.

The theif come combine two things:

1.  Him keep the transaction unconnected through the eclipse-style attack wey we talk for up.
    
2.  Him come use original bridge interaction wey go allow a specific crafted bridge-format event to fit enter the fallback process. So because of the validation wey dey miss, the fallback path come accept the crafted event.
    

E come be say the Original guardians sign VAAs wey dey: cryptographically valid — but unauthorized. The theif come redeem the messages for Ethereum and BNB Chain. Important infrome: Them no expose the guardian keys atall. Because need no dey to steal the keys. The guardians no know, dem come use their own hand sign the messages wey no pure because the software show them as message wey dey correct. The guardian set no come get any need to dey rotated.

Again, for the same matter: The Alephium network gon gor still dey unaffected.

### Timeline and Response

![](https://cdn.hashnode.com/uploads/covers/6926f4a7365f42f013759b58/51204074-b9eb-420c-a42c-90fc83f15873.png align="center")

The whole theif wey the person theif happen fast well well. The theif, theif moni wey him wan collect at around 64 seconds.

That one dey too fast for manual intervention to stop the attack wey first happen. So the shutdown wey happen sharp sharp na to stop the theif hand and to prevent am from collecting another round of money. The liquidity-withdrawal request wey the Alephium people do also help reduce the amount of liquidity wey dey available for the attacker to sell the assets wey him don thief.

Plenti informae wey carry matter dey inside the on-chain report and burn explainer.

### How We Carry Fix Am (Remediation and assurance)

Fix and Hardening The fallback path don dey fixed. As e come be, both the normal observation path and the re-observation path suppose do the same validations. As e come be the fallback path no longer fit come become route wey dey weak for matter wey involve security checks. As e carry be, beyond say to fix the vulnerability gon gor wey the theif exploit, Alephium people also carry out hardening wey big well well across the bridge codebase. For 19th of June, Alephium beign complete full manual and AI-assist review for the complete bridge codebase. The review been cover: the path wey them exploit, the validation procedures, operational workflows wey happen, and the bridge infrastructure wey wide well well.

Independent External Audit Matter Alephium people been also bring Inference AG people make them use their hand review the affected watcher component. Two auditors been work on the assessment and dem use both manual and AI-assisted methods do the work. The audit wey dem do been look at: how messages dey originate, finality, canonical-chain verification, event processing, normal observation mode, and re-observation mode. The auditors been find two low-severity issues, and dem don solve the both issues wey dem see. The report also contained two informational recommendations.

The Security Position The investigation wey we do dey make us know say e be like say the the attacker use AI-assisted tools to discover and then combine the plenti edge cases wey make the exploit dey possible. And this one dey important well well. AI don change the security game for crypto o. Theif people fit now come scan public codebases for vulnerabilities wey no dey common at machine speed. Sometimes, dem fit find combinations of edge cases fast well well pass human security team fit review the entire codebase if them dey use their hand do am manually. So people wey dey defend also suppose use the same tools. Na wetin make Alephium's full-codebase review sef use AI-assisted. Alephium also been come tightened access to security-critical watcher and guardian code. As e carry be, some operational configuration and detection details no go dey published because those details fit help attackers test or chuck hand inside the bridge. Restricted access dey help, but make we dey clear: Access control no replace proper validation, testing and external security review.

### User Assets and Bridge Relaunch

Because this thing wey happen been affect infrastructure wey dey operated by Alephium gon gor, and because the Alephium people been do something about am, we being come decide to make Original users whole. True true, this one being cost Big moni. But we believe say na the right thing to do under these circumstances as e carry be. As e carry be, we dey recognize say this same outcome fit not always dey possible for future incidents.

Before the bridge go fit open again, Alephium people go: Replace the collateral wey the theif commot. Supply native ALPH for the 500,000 circulating wALPH. Retire and reconcile treasury-held wrapped tokens. Fully back every recognized legitimate wrapped asset held by users. The remaining unbacked wALPH wey the theif hol don already dey burnt.

The Steps Before Relaunch Go Happen!

1.  Every guardian go need to upgrade to the fixed software. The guardians go need to also confirm say messages wey dey generated during the exploit period go dey rejected.
    
2.  Alephium go also reconcile: custody, bridged amounts, pending transfers, treasury-held tokens, and from there them go restore the collateral wey dey needed gon gor and bridge accounting.
    
3.  The team go verify say: native custody + recorded supply + recognized wrapped liabilities match well well gidigba for every asset. Them go also confirm say that valid transfers after the cutoff date work properly.
    
4.  The bridge interface and explorer go dey restored and verified before reopening go happen.
    

The Bridge Go Keep Him Existing Addresses Anytime wey the bridge reopen, e go use the same existing contract addresses.

The following things wey dey for under go come remain unchanged: Token IDs, Guardian set, VAA format, Recommended consistency levels wrapped assets wey dey exixt no need migration atall. Them go continue to dey support 1:1 redemption.

The relayer and explorer API go also continue to dey work the way them dey work before, while SDKs wey dem update go follow after reopening.

### The Main Lessons Wey We Learn From This Attack

Fallback paths must get the same security checks as primary paths. You no fit make your main security path strong and then leave the backup path weak. This principle wey we form don now apply across the entire Alephium bridge codebase and e also follow for part of the external audit.

AI don change crypto security well well. Thief people fit come now use AI scan public code and locate unusual edge cases extremely quick quick. That one mean say projects suppose use AI as part of their defense. Alephium own full-codebase security review dey use AI-assisted analysis together with manual review.

Bridge security no stop for the smart contract. Security perimeter wey bridge suppose get include: smart contracts, full nodes, backend infrastructure, watchers, guardian systems, and other off-chain components. This incident wey happen show us why all these components suppose dey treated as one complete security system. This one mean say the external audit no only look individual lines of code. E also look how different components fit dey chained together during when attack dey happen.

### Thank You

Na Blockaid detect the exploit first. Their alert help Alephium respond sharp sharp and them use am hold the situation before another theif theif fit happen. SEAL 911 answer our call sharp sharp and help us during the first important hours of the response. Na the bridge guardians dem coordinate the burn and na dem also coordinate the relaunch. Each guardian use their own hand verify the different steps. Inference AG people also deliver serious and adversarial-minded security audit under significant time pressure. The Swiss authorities, wey be our legal counsel and investigation partners dey continue to dey pursue the case.

And to our community: We dey say Thank you. As the gbege happen within hours of us to dey ask una to withdraw liquidity, many of una withdraw una liquidity. Una monitor the attacker addresses. Una stay alert. And una face very difficult summer with patience and trust. We no take that trust for granted. This kind thing wey happen dey show the kind people wey una, the kind better character wey una get for this community. And our community people stand with us every single day. From the entire Alephium team people: We dey say thank you.

### Investigation Status

Wey Dey For Ground! As of 21 August, the moni wey dem theif don dey reach 150.7 ETH from the proceeds and the theif been mixed am Tornado Cash. Na about 4.4 ETH remain inside wallets wey belong to the theif. The don share addresses wey matter with police people and blockchain-tracing partners.

### Appendix: Addresses

Theif Person Main Wallet — ETH + BSC 0x6681ebC82551fE52fDB48E65872e85a3ae06921d

Attacker Consolidation Wallet 0xb80a7d612480d121696be6dfe062f5e6d984bfd4

Attacker Tornado Feeder Wallet 0xEC60E38Fa836f377B716680963343526Ee3F7E69 Attacker wALPH Parking Wallet 0x0baD8f95a996DeADe828d21DAd765b60c2b2509c

Fake-Event Contract (Alephium) 24ZjqcvV8vVCn29zd1TThqAtaS8pMvJ4Co1MK5zncPcABE

Ethereum TokenBridge - 0x579a3bDE631c3d8068CbFE3dc45B0F14EC18dD43

BNB Chain TokenBridge- 0x2971F580C34d3D584e0342741c6a622f69424dD8

Burn Transaction 2 June Block 25,230,400 0xade2846a20169aa23d53203e1c3c509474694710a9f4674307c220528d27a4b1

Full transaction list: Make you see the on-chain report.

* * *

**Disclaimer**

**This is a community-run blog for third-party contributors. The views expressed here are those of the authors and do not reflect the official Alephium project. This content is for informational purposes only and does not constitute financial, legal or investment advice. Cryptocurrency carries risk and is highly volatile. Information may be incomplete or outdated. Always conduct your own research. We disclaim liability for any loss or damage resulting from reliance on this article.**