Allbridge Core halts after $1.65M flash-loan exploit

Allbridge Core paused protocol operations after a flash-loan exploit that drained about $1.65 million. Security and blockchain analysis firms identified the attack and flagged the addresses involved.

According to Onchain Lens, the exploiter opened a $1.12 million flash loan on Kamino, a Solana-based liquidity protocol, and rapidly swapped USDC for USDT. That sequence skewed stablecoin pool ratios, enabling withdrawals at distorted rates. PeckShield and CertiK reported that the funds were bridged from Solana to Ethereum and routed through privacy tools.

The attack used a flash loan, a one-transaction loan that requires no upfront collateral, to supply the capital for rapid trades. By changing reserve ratios in the stablecoin pool with large, fast swaps, the attacker created short-lived pricing distortions and withdrew assets before the pool could rebalance.

Allbridge paused affected pools and asked users to withdraw liquidity. The protocol posted that the resulting pool imbalance “created a temporary positive arbitrage window” and requested that anyone who benefited consider returning funds to a provided address. The team said its goal is to “return all affected funds” to users and indicated it will pursue remediation options.

Security firms continue to track on-chain movements and have flagged the addresses involved. Privacy layers and cross-chain bridges are complicating tracing and recovery. Investigations are ongoing and the community is watching for any returned funds or further updates from Allbridge.