Allbridge spent 2023 explaining why this exact attack could never work on its pools again.
On Sunday night an attacker drained roughly $1.65 million in stablecoins out of Allbridge Core’s Solana liquidity pools, and the method was not some novel zero-day that nobody saw coming. It was a flash loan pool-ratio manipulation, the same class of attack that hit Allbridge’s BNB Chain pools in May 2023 for about $570,000. Back then the team published a postmortem, took the loss on the chin, and committed to an architectural change that was supposed to make the whole category of attack structurally impossible going forward. Three years later, that promise met reality on a different chain, and reality won. The protocol has since paused Core while it investigates.
For anyone who provides liquidity to cross-chain bridges, this one is worth reading past the headline number. The dollar figure is small by 2026 standards, well under what Ostium lost to a compromised oracle key just five days earlier, and nowhere near the nine-figure bridge disasters that defined the last cycle. But the size of the loss is not really the story here. The story is that a documented vulnerability with a documented fix stayed open on a production chain for three years, and nobody caught it until someone with a Kamino account decided to check.
How the attacker allegedly pulled it off
The sequence started with a $1.12 million flash loan taken from Kamino, a Solana lending protocol. Flash loans let you borrow a large sum with no collateral as long as you repay it inside the same transaction, which makes them perfect for anyone who wants temporary size to push a pool out of balance. The attacker used that borrowed capital to rapidly swap USDC for USDT inside Allbridge’s Solana pools, skewing the ratio between the two assets far away from where it should sit. Allbridge’s pricing math then treated that distorted ratio as real, which let the attacker withdraw more value than they put in. Repeat the loop, repay the loan, keep the difference, and walk away with roughly $1.65 million in about the time it takes to read this paragraph.
None of that is exotic. Flash loan pool manipulation has been in every DeFi security checklist since 2020, and auditors flag it as a matter of routine. What makes it work is a specific structural condition: two or more swappable assets sitting in pools that can be interacted with inside a single atomic transaction. Remove that condition and the attack has nothing to grip. That is precisely what Allbridge said it was doing after the BNB Chain incident.
The 2023 fix that never reached Solana
After the May 2023 attack, Allbridge’s stated remedy was to move to a single liquidity pool per blockchain. One pool means no sibling pool to swap against, no ratio to distort, and no path for a flash loan to do anything useful. On paper it is a clean fix, and it is the kind of answer that reassures depositors because it changes the shape of the system rather than patching a symptom. The team also recovered roughly $465,000 of the 2023 losses through a white-hat arrangement with the attacker, which at the time looked like a reasonably competent handling of a bad week.
The Solana deployment, though, was still running USDC and USDT pools side by side. That is exactly the configuration the single-pool policy was meant to retire. Whether it was never migrated, was migrated and later reverted, or simply predates the policy in a way nobody revisited, the practical result is the same. A security commitment that existed in a blog post did not exist in the code on at least one chain, and there was apparently no process catching the gap. On-chain analysts including researchers tracking the incident flagged the pause and the fund movements within hours.
Where the money went, and what Allbridge is asking for
The stolen stablecoins were bridged from Solana to Ethereum and then split across multiple addresses, with portions reportedly routed into privacy pools to make tracing harder. That is a familiar pattern at this point and it usually means recovery odds drop sharply once the funds land. Allbridge has paused Core operations, advised liquidity providers to withdraw, and made an additional request that says a lot about how these events actually unfold: it asked traders who profited from the temporary pool imbalance to send the money back. Ordinary arbitrage bots almost certainly picked up free value while the pools were skewed, and those operators did nothing wrong beyond taking a trade the market offered them. Getting that money back is a matter of goodwill, not enforcement, so nobody should count on it.
There is no compensation plan announced yet and no timeline for Core coming back online. Anyone with capital still parked in Allbridge pools on any chain should treat the withdrawal advisory as the operative instruction rather than waiting to see how the investigation reads.
Lessons Learned?
Bridges remain one of the most attacked surfaces in crypto for an obvious reason: they concentrate a lot of idle capital in contracts that have to trust conditions on two different chains at once. What happened here is worse than a clever exploit, because a clever exploit at least implies the defenders were beaten by something new. This was a known attack against a known configuration on a protocol that had already been burned by it once and had publicly described the cure.
If you provide liquidity anywhere, the useful takeaway is that a postmortem is a statement of intent, not proof of work completed. Ask which chains a fix actually shipped to. Multi-chain deployments drift, and the chain everyone stopped watching is the one that gets hit. Allbridge will probably survive this given the modest size of the loss, but the reputational damage of getting caught by your own 2023 homework is going to stick around a lot longer than $1.65 million.
—————
Author: Rowan Marrow
Seattle Newsroom
Breaking Crypto News
Be the first to comment