Allbridge Core hacked for $1.65M using the same trick as in 2023

Cross-chain bridge Allbridge Core was hit by a flash-loan attack and lost roughly $1.65 million from its Solana deployment. The team paused the protocol and urged users to withdraw liquidity from the affected pools.

How the Attack Worked

The attacker took out a $1.12 million USDC flash loan from Solana lending protocol Kamino and used it to execute a series of rapid USDC-to-USDT swaps through Allbridge's pools, deliberately skewing the ratio between the two stablecoins. That let them withdraw liquidity at a favorable, manipulated rate and pocket the difference.

The stolen funds were bridged from Solana to Ethereum, then swapped into ETH and routed through privacy protocols to make tracing the final recipient harder.

What the Team Is Doing

Allbridge said its goal is to "return all affected funds" to users, and appealed not just to the main attacker but to any traders who took advantage of the price imbalance created by the manipulation to arbitrage a profit, asking them to return the proceeds to a designated address. According to the team, all returned funds will go directly toward compensating affected liquidity providers.

Not the First Time

This is the second flash-loan exploit to hit Allbridge: back in April 2023, the protocol lost about $573,000 to a swap-rate manipulation in a pool on BNB Chain. The team recovered roughly $465,000 of that at the time by offering the attacker a white-hat bounty in exchange for returning the funds.

What This Means in Practice

A nearly identical attack mechanism repeating itself three years later shows that protecting liquidity pools from flash-loan price manipulation remains a systemic problem for cross-chain bridge protocols, not something solved once and for all: patching the specific vulnerability exposed by one incident doesn't necessarily protect a structurally similar part of the same pool architecture from a repeat attack.

This material is for informational purposes only and is not investment advice.