Allbridge Core hacked for $1.65 million, protocol paused

Cross-chain protocol Allbridge Core has paused operations after a Solana-side exploit that PeckShield estimates at roughly $1.65 million. The stolen funds have already been bridged from Solana to Ethereum.

How the attack worked

• The attacker took out a $1.12 million USDC flash loan from the Solana lending protocol Kamino.
• Using a series of rapid USDC/USDT swaps in an Allbridge Core liquidity pool, they deliberately skewed the price ratio between the two stablecoins.
• Because the protocol prices liquidity withdrawals off that ratio, the distorted rate let the attacker withdraw funds at an artificially favorable price.
• The flash loan was repaid within the same transaction, leaving the difference as the attacker’s profit.

Allbridge’s response

“Allbridge Core is experiencing a security incident. We have paused the protocol as a precaution while we investigate. If you have liquidity in affected pools, please withdraw now.”

— Allbridge

The team has also asked anyone who profited from the resulting price distortion to return the funds to a recovery address set up to compensate affected users. No timeline for resuming the protocol has been announced.

Not the first incident

This is Allbridge’s second major exploit: in April 2023, the protocol lost about $573,000 to a swap-price manipulation on a BNB Chain pool, and later recovered roughly $465,000 after negotiating a white-hat deal with the attacker.

This material is for informational purposes only and is not investment advice.