Allbridge Core suspended its cross-chain stablecoin protocol after an attacker stole approximately $1.65 million from its Solana liquidity pools, according to security firms CertiK and PeckShield.
Allbridge is a bridge that allows users to move assets between blockchains that do not communicate directly. Its core product uses liquidity pools to transfer native stablecoins such as USDC and USDT without issuing wrapped versions of the assets.
The attacker used a $1.12 million flash loan from the Solana Kamino lending protocol to quickly swap USDC and USDT, manipulating the pools’ internal ratios before withdrawing the assets at favorable rates, according to Onchain Lens. A flash loan is a loan taken out and repaid in the same transaction.
The stolen assets were linked to an Ethereum address and scattered across additional addresses. It is not yet clear what exactly remains under the attacker’s control.
Allbridge said it suspended the protocol during its investigation and asked liquidity providers to withdraw from affected pools. The initial manipulation unbalanced the pools and created a temporary arbitrage opportunity. Allbridge asked traders who took advantage of the price distortion to return the funds for LP compensation.
Allbridge suffered a similar flash loan attack in 2023 that drained approximately $650,000 from its BNB chain pools. The company later said it had recovered most of the funds and changed its liquidity and withdrawal calculations. Allbridge had raised $2 million in 2022 to expand the bridge and fund safety audits.
