Allbridge Core paused its protocol this week after an attacker exploited its stablecoin liquidity pools on Solana, making off with more than $1 million. Blockchain tracker Onchain Lens pegged the losses at over $1.1 million. The exploit is the second flash loan attack to hit Allbridge in just over three years.
How the exploit worked
The attacker took out a $1.12 million USDC flash loan from Kamino, a lending protocol on Solana. They used those funds to rapidly swap between USDC and USDT in Allbridge's stablecoin pool, distorting the ratio of the two assets. Once the pool was out of balance, the attacker withdrew liquidity at inflated values — then repaid the flash loan in the same transaction. The net extraction was roughly $1.1 million.
The largest single withdrawal came in at $2.24 million USDC. Stolen funds were later routed through privacy protocols to obscure their movement.
A familiar target
This isn't the first time Allbridge has been hit. In April 2023, a similar flash loan exploit on the BNB network cost the protocol about $570,000. That attack also targeted stablecoin pools. The repeat incident raises questions about the security of Allbridge's cross-chain infrastructure, though the company hasn't detailed what changed — or didn't — since the earlier breach.
The response
Allbridge paused the protocol as a precaution and opened an investigation. The team noted that the imbalance briefly created an arbitrage window for some traders. In a statement, Allbridge asked anyone who profited from that window to return funds to a specified address. It's unclear how much was taken by arbitrageurs versus the attacker.
July's exploit tally
The Allbridge hack is part of a rough month for crypto security. Across all protocols, July 2026 has seen $57.8 million in losses from exploits, according to available data. That figure could climb as more incidents are reported.
Allbridge hasn't said when it expects to resume operations. The investigation is ongoing.
