Allbridge Halts Core Bridge After $1.65M Flash Loan Exploit

Cross-chain protocol Allbridge paused its Core bridge on July 20 after an attacker drained roughly $1.65 million from its Solana liquidity pools, according to blockchain security firms PeckShield and CertiK.

"Allbridge Core is experiencing a security incident, and the protocol has been paused as a precaution," the team said, warning liquidity providers: "If you have liquidity in affected pools, please withdraw now."

Allbridge Core moves native stablecoins such as $USDC and $USDT across chains using liquidity pools, rather than issuing wrapped tokens. The attacker took out a $1.12 million flash loan — a loan borrowed and repaid within a single transaction — from Solana lending protocol Kamino, then rapidly swapped $USDC and $USDT to distort the pools' internal ratios before withdrawing assets at favorable rates, on-chain analyst Onchain Lens reported.

The stolen funds were bridged to an Ethereum address and dispersed across additional wallets. Allbridge said the manipulation left its pools imbalanced, creating a temporary arbitrage window, and asked traders who profited from the distortion to return funds to compensate affected liquidity providers.

A Repeat of 2023

The incident echoes a flash loan attack in 2023 that drained roughly $650,000 from Allbridge's BNB Chain pools. In its postmortem at the time, Allbridge committed to deploying a single liquidity pool per chain, an architecture intended to make same-transaction flash loan manipulation structurally impossible.

The July exploit targeted a $USDC and $USDT pool operating side by side on Solana — the multi-stablecoin configuration the earlier fix was meant to eliminate. Allbridge said it recovered most of the funds after the 2023 incident.

The protocol has not published a final accounting of how much of the $1.65 million remains under the attacker's control or laid out a timeline for resuming operations.