Cross-chain stablecoin bridge Allbridge Core has paused its protocol after a security incident on Solana resulted in estimated losses of approximately $1.65 million, according to blockchain security firms PeckShield and CertiK.
Allbridge announced the precautionary shutdown on July 19 and urged liquidity providers with funds in affected pools to withdraw them while the team investigates. The protocol had not provided a timetable for reopening or released a complete technical post-mortem at the time of publication.
On-chain analysis indicates that the attack targeted Allbridge Core’s USDC-USDT liquidity pool on Solana. The exploiter reportedly borrowed roughly $1.12 million in USDC through a flash loan from Kamino, a Solana-based lending and liquidity protocol.
The attacker then executed rapid swaps between USDC and USDT, distorting the ratio of assets held in the Allbridge pool. By manipulating the pool’s internal pricing, the exploiter was able to withdraw liquidity at an artificially favorable exchange rate, repay the flash loan within the same transaction and retain the extracted funds.
Estimates of the loss vary. Onchain Lens calculated that more than $1.1 million was directly extracted through the transaction, while PeckShield and CertiK placed the broader impact at about $1.65 million.
Flash Loan Exposes Pool-Pricing Weakness
Flash loans allow traders to borrow large amounts of digital assets without posting collateral, provided the loan is repaid before the blockchain transaction is completed. The mechanism is widely used for arbitrage and liquidity management, but it can also give attackers enough temporary capital to manipulate thin or improperly protected markets.
The Kamino loan itself was not necessarily the vulnerability. Instead, the borrowed funds reportedly enabled the attacker to move the Allbridge pool’s asset ratio far enough for its pricing logic to produce an exploitable withdrawal rate.
The incident also left affected liquidity pools temporarily imbalanced, creating what Allbridge described as a positive arbitrage opportunity. The team asked traders who benefited from the abnormal pricing to consider returning their profits to a designated recovery address, saying the funds would be used to compensate affected liquidity providers.
Security researchers said the attacker subsequently bridged the stolen assets from Solana to Ethereum and began routing funds through privacy-focused protocols, making recovery and attribution more difficult.
Allbridge said its objective is to return all affected funds, although it has not yet outlined a formal reimbursement plan or confirmed how much liquidity remains recoverable.
Second Major Exploit Raises Bridge-Security Concerns
The attack is not Allbridge’s first major security incident. In April 2023, an exploiter manipulated the swap price of a liquidity pool on BNB Chain and drained approximately $573,000. The protocol later recovered around $465,000 after offering the attacker a white-hat bounty.
The similarity between the two incidents will likely attract scrutiny. Both involved manipulating pool pricing rather than compromising user wallets or stealing private keys, highlighting the risks associated with liquidity-based bridge designs and exchange-rate calculations.
Cross-chain bridges remain among the most frequently targeted components of decentralized finance because they hold pooled assets across multiple blockchains and rely on complex smart contracts, validators and pricing mechanisms.
For Allbridge users, the immediate priority is the safety of remaining liquidity and the scope of any compensation. For the broader sector, the incident reinforces the need for tighter slippage controls, manipulation-resistant pricing, transaction-size limits and real-time monitoring of sudden pool imbalances.
Until Allbridge publishes a detailed investigation, the precise vulnerability and full financial impact remain unconfirmed. The protocol’s reopening will likely depend on whether the team can patch the pricing weakness, verify unaffected deployments and establish a credible recovery plan for liquidity providers.
