Cross-chain protocol Allbridge has suspended operations after a flash loan attack drained roughly $1.65 million from its liquidity pools. The exploit, which took place on the Solana network, used a $1.12 million flash loan from the lending protocol Kamino to manipulate pool ratios and withdraw assets at favorable exchange rates.
How the exploit worked
The attacker took out a flash loan from Kamino — a loan that must be repaid within the same transaction — and used those funds to artificially shift the balance of Allbridge's liquidity pools. By temporarily inflating one side of a pool, the attacker was able to withdraw a larger amount of another asset at a distorted rate. After the withdrawal, the flash loan was repaid, leaving Allbridge's pools short by about $1.65 million.
Flash loans themselves are a common DeFi tool, but they become dangerous when combined with price manipulation or oracle weaknesses. In this case, the attacker exploited the way Allbridge's pools calculate exchange rates based on their internal token balances.
Allbridge's response
Allbridge confirmed the incident on social media and said it had paused all operations to investigate. The team said it is working on a plan to recover funds and will share details once the investigation is complete. Users have been advised not to deposit or withdraw until further notice.
The protocol has not announced a timeline for resuming services. It is unclear whether the stolen funds can be recovered or if Allbridge will compensate affected users.
The role of Kamino
Kamino, the lending protocol that provided the flash loan, was not directly targeted. Flash loans are a standard feature on many DeFi platforms and are often used for legitimate arbitrage and refinancing. However, they also enable attacks when combined with vulnerabilities in other protocols. Kamino has not commented on the incident.
The exploit highlights a persistent risk in decentralized finance: even when individual protocols are secure, the composability of DeFi can create unexpected attack surfaces. Allbridge is the latest in a string of cross-chain bridges and liquidity protocols to suffer a flash loan attack.
Allbridge has not said whether it will implement new safeguards or change its pricing mechanism. The team is expected to release a post-mortem report in the coming days.
