Allbridge Core Exploit: $1.65M Drained, Bridge Paused

Allbridge paused its Core cross-chain stablecoin bridge on July 19 after an attacker pulled roughly $1.65 million out of its Solana pools. PeckShield and CertiK put the loss at that level and confirmed the pause.

There was no stolen key and no broken bridge contract here. The attacker used borrowed money and a flaw in how the pools priced themselves.

How the Kamino flash loan drained the pools

Onchain Lens laid out the transaction. The attacker borrowed $1.12 million in USDC from Kamino, swapped USDC and USDT back and forth fast enough to skew the pool ratio, then withdrew liquidity at the inflated rate and repaid the loan in the same transaction.

A flash loan lets someone borrow and repay inside one blockchain transaction, with no collateral. The borrowing itself was fine. The trouble was that Allbridge Core read its prices directly off pool balances, and $1.12 million was enough to move those balances where the attacker wanted them.

From there the money kept moving. It went from Solana to Ethereum and then into privacy pools, which makes it harder to trace and harder to recover.

What Allbridge told liquidity providers

Allbridge posted on X within hours. It said Core had suffered a security incident, that the protocol was paused while the team investigates, and that anyone with funds in the affected pools should withdraw now.

The team also made an unusual request. It said the imbalance briefly handed some traders an easy arbitrage profit, and asked them to return that money so it can repay the liquidity providers who lost out. Allbridge published a return address and said it wants every affected user paid back.

A repeat of the 2023 BNB Chain hit

Allbridge has been through a version of this before. In April 2023 an attacker rigged swap prices on its BNB Chain pool for about $573,000, and the project later recovered around $465,000 after offering a white-hat reward. The playbook looked similar: act as both liquidity provider and swapper, bend the price, then withdraw at the rigged rate.

Where this sits in a rough stretch for bridges

The final figure is not settled. Onchain Lens tracked about $1.1 million leaving in the transaction, while PeckShield put the total closer to $1.65 million, and no Allbridge postmortem has reconciled the two.

Bridges have taken a run of hits lately. By one count, this is at least the sixth cross-chain bridge attack since May. They tend to sit on large pooled reserves, which keeps them near the top of attackers’ lists.