important · Research — Bridge security
An eclipse attack and a fallback-validation gap made Alephium guardians sign unauthorized asset movements.
Affects
Alephium TokenBridge's hosted watcher, full-node, and guardian infrastructure connecting Alephium with Ethereum and BNB Chain.
The fallback path accepted a crafted bridge-formatted event without normal validation, producing guardian signatures that could withdraw collateral and mint unbacked wALPH.
Detail and 2 sources
Alephium reports that the chain was used and has published a fix.