Cross-chain protocol Allbridge halts after $1.65 million flash loan exploit

Allbridge Core has paused its cross-chain stablecoin protocol after an attacker stole roughly $1.65 million from its Solana liquidity pools, according to security firms CertiK and PeckShield.

Allbridge is a bridge that lets users move assets between blockchains that do not communicate directly. Its Core product uses liquidity pools to transfer native stablecoins such as USDC and USDT without issuing wrapped versions of the assets.

The attacker used a $1.12 million flash loan from Solana lending protocol Kamino to rapidly swap USDC and USDT, manipulating the pools’ internal ratios before withdrawing assets at favorable rates, according to Onchain Lens. A flash loan is a loan taken and repaid within the same transaction.

The stolen assets were bridged to an Ethereum address and dispersed across additional addresses. It isn’t currently clear how much remains under the attacker’s control.

Allbridge said it paused the protocol while investigating, and told liquidity providers to withdraw from affected pools. The initial manipulation left the pools imbalanced and created a temporary arbitrage opportunity. Allbridge asked traders who profited from the pricing distortion to return funds for LP compensation.

Allbridge suffered a similar flash loan attack in 2023 that drained roughly $650,000 from its BNB Chain pools. The firm later said it recovered most of the funds and changed its liquidity and withdrawal calculations. Allbridge had raised $2 million in 2022 to expand the bridge and fund security audits.