GoCheckMyCrypto.comCross-chain protocol Allbridge halts after $1.65 million flash loan exploit
Allbridge Core paused its cross-chain stablecoin protocol on July 20 after a $1.65 million flash loan attack drained its Solana liquidity pools. The attacker used a $1.12 million flash loan to manipulate pool ratios, then withdrew assets at favorable rates. The incident marks the second major flash loan attack on Allbridge in three years.
Allbridge Core, a cross-chain bridge that transfers native stablecoins between blockchains without issuing wrapped versions, paused operations on July 20 following a $1.65 million flash loan exploit on its Solana liquidity pools, according to CoinDesk reporting.
The attack exploited a known vulnerability in how liquidity pools calculate withdrawal rates. An attacker obtained a $1.12 million flash loan from Solana lending protocol Kamino, then used it to rapidly swap USDC and USDT across Allbridge's pools, manipulating their internal ratios before withdrawing assets at artificially favorable rates, per CoinDesk's analysis. The stolen assets were then bridged to Ethereum addresses and dispersed across multiple wallets. It is not currently clear how much of the $1.65 million remains under the attacker's control.
Allbridge responded by pausing the protocol and instructing liquidity providers to withdraw from affected pools. The company also asked traders who profited from the pricing distortion to return funds for LP compensation.
The incident echoes a flash loan attack Allbridge suffered in 2023, when a similar exploit drained roughly $650,000 from its BNB Chain pools. After that attack, Allbridge said it recovered most funds and implemented changes to its liquidity and withdrawal calculations. The protocol also raised $2 million in 2022 to expand the bridge and fund security audits.
The recurrence of structurally similar attacks raises questions about whether Allbridge's 2023 remediation measures addressed only symptoms rather than underlying design flaws. Open questions remain about what specific changes were made after the 2023 attack, why they did not prevent the 2026 exploit, how much of the current loss can be recovered, and what additional safeguards will be deployed before the protocol resumes.
Allbridge Core halted operations following a $1.65 million flash loan exploit on Solana, nearly identical in structure to a $650,000 attack the protocol suffered in 2023.
Watch for Allbridge's postmortem findings and timeline for protocol restart. The key question: are the root causes of both attacks inherent to Allbridge's architecture, or do they reflect a class of vulnerability that affects other cross-chain bridges. If the latter, expect broader scrutiny of liquidity pool design across the bridge ecosystem.
And that's the way it is.
Sources
Not financial advice. Crypto Cronkite reports events and explains what they may mean. It never tells you to buy or sell anything. Do your own research.