Allbridge Hits Pause, Again — Flash Loan Drains $1.65M From Solana Pools 🌉

Cross-chain bridge Allbridge paused its protocol on Sunday after an attacker drained roughly $1.65 million from its Solana deployment in a flash loan attack, according to the project and blockchain security firms PeckShield and CertiK. Allbridge Core lets users move assets between blockchains without natively wrapped tokens by holding pools of native stablecoins such as USDC and USDT. In a post on X, the team said, "Allbridge Core is experiencing a security incident. We have paused the protocol as a precaution while we investigate. If you have liquidity in affected pools, please withdraw now."

Security firm CertiK detailed that the attacker took out a $1.12 million USDC flash loan from Solana lending protocol Kamino, then executed a rapid series of USDC/USDT swaps that distorted Allbridge Core's internal pool pricing. With the pool mispriced, the attacker swapped a few thousand dollars of USDT for about $2.24 million in USDC, bridged the proceeds from Solana to Ethereum address 0x651591b68A9c9650FB23F642162353306281ffDe, and dispersed the funds further. Allbridge later noted the team was "preparing a detailed breakdown" and post-mortem, adding, "There is no threat to users liquidity right now," as it worked to relaunch Core without liquidity pools.

The incident marks at least the sixth cross-chain bridge exploit since May. In June, Ethereum layer-2 Taiko lost $1.7 million in a bridge exploit, reopening 11 days later after a four-step recovery plan; earlier, Secret Network suffered a $4.67 million "infinite mint" bug on a vulnerable smart contract that produced unbacked Axelar-wrapped assets. Other recent bridge incidents targeted Gravity Bridge, Verus Bridge and the Butter Network. Bridges remain attractive targets because they typically hold large pools of liquidity backing bridged assets on destination chains.

The price manipulation briefly opened what Allbridge described as a "temporary positive arbitrage window," during which other traders could buy mispriced assets. The team urged anyone who profited from the imbalance to return the funds to a designated address, saying the money would "go directly toward compensating affected LPs" and that its "goal is to return all affected funds." Lookonchain's Onchain Lens earlier reported the same swap-and-drain pattern.

It is not the first time Allbridge has been hit this way. In April 2023, a similar flash-loan exploit drained around $573,000 from its BNB Chain pools; the project later said it recovered most of the funds and revised how it calculates liquidity and withdrawals. Allbridge raised $2 million in 2022 to expand the bridge and fund security audits.