Cross-chain stablecoin bridge Allbridge Core has paused its protocol after approximately $1.65 million was drained from its liquidity pools on Solana. Blockchain security firms CertiK and PeckShield confirmed the exploit.
Allbridge enables users to transfer assets between blockchains that do not communicate directly with each other. Its Core product moves native stablecoins such as USDC and USDT from one network to another through liquidity pools, without creating wrapped versions of the assets.
How did the attack happen?
According to Onchain Lens, the attacker took out a $1.12 million flash loan from Solana-based lending protocol Kamino. A flash loan is an uncollateralized loan borrowed and repaid within the same transaction, meaning the attacker did not need to provide any capital upfront.
The attacker then used the borrowed funds to execute a series of trades between USDC and USDT in an Allbridge Core stablecoin pool, disrupting the pool’s internal pricing balance.
According to analyst DBCrypto, the sequence was straightforward: borrow the funds, distort the exchange rate, withdraw assets at the manipulated price, repay the loan and keep the difference. Simple, yet effective. A single withdrawal transaction was reportedly worth approximately $2.24 million.
The stolen assets were bridged to Ethereum and distributed across multiple addresses. Some reports suggest that the funds are being routed through privacy-focused infrastructure, which could make them more difficult to trace. It remains unclear how much the attacker still holds.
Allbridge responds to the exploit
Allbridge announced that it had paused the protocol as a precaution while investigating the incident. The team also urged liquidity providers in the affected pools to withdraw their funds.
The manipulation created a temporary imbalance in the pools, allowing some traders to profit from arbitrage opportunities. Allbridge is now asking these traders to return the funds so they can be used to compensate liquidity providers.
Spot On Chain analyst Hupzy described the rapid movement of funds from Solana to Ethereum as a common money-laundering tactic and said it could complicate recovery efforts.
Still, Hupzy noted that the loss remains small compared with Solana’s total market capitalization. Therefore, the exploit is expected to have only a limited direct impact on SOL’s price.
Solana market remains calm
At the time of writing, SOL is trading at $76.66, up 1.06% over the past 24 hours. Its daily trading volume has reached $1.43 billion.
The main concern centers on trust rather than price. Incidents of this kind weaken confidence in cross-chain bridges, which have repeatedly become targets for hackers because of the large amounts of liquidity they hold.
Whether the exploit will accelerate withdrawals from Solana-based bridges and how it will affect the total value locked in these protocols should become clearer in the coming days.
This is not the first time
Allbridge suffered a similar flash loan attack targeting its BNB Chain pools in 2023. That incident resulted in losses of approximately $650,000.
The company later said it had recovered most of the stolen funds and reviewed its liquidity and withdrawal calculation mechanisms.
Allbridge also raised $2 million in 2022 to expand its bridge infrastructure and allocate more resources to security audits. The fact that the same type of attack proved effective again three years later raises fresh questions about how much progress the protocol has made in addressing this vulnerability.
