A full technical breakdown of how the burn was executed was published walking through the technical process behind how the attacker's wALPH was burned, including the guardian coordination process. x.com/alephium/status/206253…

Smart Contract Assets and Native Assets This remediation action also highlights an important architectural distinction between smart contract-managed assets and native protocol assets. The remediation action described above was possible because wALPH exists as a smart contract-managed asset on Ethereum. Like most assets on Ethereum, ownership and balances are ultimately defined by contract state rather than by the Ethereum protocol itself. Depending on how a token is designed, contract administrators may have the ability to freeze assets, blacklist addresses, destroy tokens, upgrade contract logic, or introduce new functionality through governance processes. In some cases, these capabilities are built into the contract from the outset, while in others, they can be introduced through an upgrade if the contract architecture permits it. Well-known examples include centralized stablecoins such as USDT, where issuers maintain the ability to freeze or blacklist addresses under certain circumstances. The governance requirements for such actions vary significantly. Some systems require broad multi-party consensus, while others can be controlled by a much smaller set of administrators. The bridge remediation described in this report required approval from the full Guardian set before the temporary upgrade could be executed. Native Alephium assets operate differently. ALPH and all native Alephium-issued tokens are first-class protocol assets recorded directly by the blockchain's UTXO model rather than balances maintained by a smart contract. As a result, their ownership cannot be modified through a contract upgrade, administrative function, or by changing or removing the code that originally issued them. Achieving an equivalent outcome for a native Alephium asset would require a protocol-level network upgrade with broad ecosystem consensus, rather than a change to an individual application or contract. This architectural distinction is one of the key differences between Alephium's asset model and the asset model used by EVM-based chains. As native Alephium assets are first-class protocol objects rather than balances managed by application-level contracts, they deliver significantly stronger guarantees that ownership and transfer rules cannot be altered at the application level. This substantially reduces this category of governance and smart contract risk. Alephium supports both models. Developers can issue native first-class assets directly at the protocol level, or create smart contract-managed assets when additional functionality, programmability, or administrative controls are required by the application. The investigation and remediation process remains ongoing. Further updates will follow. Thank you for your support.

While we continue working on the full postmortem, we would like to share some additional information about the attack. The attacker did not succeed with their first attempts. Prior to the successful exploit, multiple malicious attempts were rejected by the bridge's standard validation workflow. Our investigation indicates that the attacker later combined the backend vulnerability with an eclipse-style attack against the P2P network. This disrupted affected full nodes and triggered a fallback workflow within the bridge backend. The vulnerable logic existed within this fallback path and was subsequently exploited. The exploit remains fully contained. The bridge was shut down immediately after the incident was identified, and the exploit path is no longer available. We will provide the complete technical details, timeline, and remediation measures in the full postmortem.

P.S. Impersonators are using additional methods, such as creating fake Alephium websites, apps, and channels. Some are even getting golden checkmarks on their X profiles to appear credible. Be cautious.