Key Takeaways:
- Attacker used $1.12M USDC flash loan from Kamino to manipulate pool rates
- Allbridge paused its Solana deployment and asked arbitrageurs to return funds
- The exploit is the sixth cross-chain bridge attack since May
Back
Allbridge Core loses $1.65M in flash loan exploit on Solana
Allbridge Core lost about $1.65M after an attacker manipulated its stablecoin pool on Solana using a flash loan, the team said July 19.
"Allbridge Core is experiencing a security incident," the team said in a post on X. "We have paused the protocol as a precaution while we investigate."
Onchain Lens reported the attacker borrowed $1.12M USDC via a Kamino flash loan, then executed rapid USDC/USDT swaps that distorted the pool's exchange rate. The attacker withdrew liquidity at the manipulated rate, repaid the loan within the same transaction, and kept the difference. The largest single withdrawal was $2.24M USDC, per Onchain Lens. The stolen funds were later bridged from Solana to Ethereum and routed through privacy protocols.
The exploit adds to a growing tally of cross-chain bridge attacks — at least six since May — that have drained more than $57.8M from crypto protocols in July alone. Allbridge said it aims to return all affected funds and asked traders who profited from the resulting arbitrage window to return the money.
"The resulting pool imbalance created a temporary positive arbitrage window," Allbridge said. "If you took advantage of it, please consider returning funds — this will go directly toward compensating affected LPs."
The incident follows a similar flash loan exploit that hit Allbridge in April 2023, when an attacker drained about $570K from a pool on the BNB chain. Other recent bridge exploits include Taiko's $1.7M incident in June, Secret Network's $4.67M infinite mint exploit, and attacks on Gravity Bridge, Verus Bridge, and Butter Network.
This article is for informational purposes only and does not constitute investment advice.
