Allbridge halts protocol after $1.65M flash loan exploit
Cross-chain bridge Allbridge Core lost $1.65 million to a flash loan exploit, underscoring persistent security vulnerabilities in decentralized finance infrastructure as bridge attacks accelerate.
Allbridge has paused its cross-chain stablecoin bridge, Allbridge Core, after an attacker drained $1.65 million from its Solana deployment on Sunday. The stolen funds were swiftly moved from Solana to Ethereum and routed into privacy pools, complicating any potential recovery efforts. “Allbridge Core is experiencing a security incident,” the company stated. “We have paused the protocol as a precaution while we investigate. If you have liquidity in affected pools, please withdraw now.”
The exploit relied on a familiar decentralized finance attack vector. According to on-chain analytics from Lookonchain and Onchain Lens, the attacker borrowed a $1.12 million USDC flash loan from Kamino. They then executed rapid USDC/USDT swaps to severely distort the bridge’s stablecoin exchange rate. By withdrawing liquidity at these artificially manipulated rates and repaying the initial flash loan, the attacker pocketed the roughly $1.65 million difference.
Allbridge acknowledged the mechanics of the breach and appealed to decentralized finance traders who might have profited from the resulting market dislocation. “The resulting pool imbalance created a temporary positive arbitrage window. If you took advantage of it, please consider returning funds… this will go directly toward compensating affected LPs,” the company said. The incident exposes the concentrated risks liquidity providers face when locking assets in protocols vulnerable to sudden price manipulation.
Recurring vulnerability
This is the second time Allbridge Core has fallen victim to a flash loan attack. In April 2023, a similar manipulation of swap prices on the BNB Chain resulted in a $573,000 loss involving BUSD and USDT.
More broadly, the Allbridge breach is at least the sixth attack targeting a cross-chain bridge since May. Bridges are highly lucrative targets because they secure large capital reserves to back assets on destination blockchains. Recent victims include Taiko, which lost $1.7 million in June, and Secret Network, which suffered a $4.67 million exploit. Others include Gravity Bridge, Verus Bridge and Butter Network.
For institutional investors, the repeated failure of bridge security raises fundamental questions about the safety of cross-chain capital deployment. Despite the critical role these protocols play in connecting fragmented blockchains, their underlying smart contracts frequently remain exposed to relatively simple manipulation tactics.
