7 minutes to sweep away $810k and still over-mint—cross-chain bridge security models need to be rewritten

On May 30, reports indicated that Alephium TokenBridge's Ethereum cross-chain bridge was attacked. The attacker controlled 3 of the 4 Guardian keys, forged VAA, and within approximately 7 minutes, stole assets worth about $815k, minted 13.76 million wrapped ALPH tokens, exceeding 100% of the circulating supply, and unlocked and transferred USDT, USDC, WBTC, and WETH from the custodial pool. Currently, the attacker's address still holds the stolen assets worth about $815k and 13.76 million uncollateralized wrapped ALPH tokens.