Allbridge, a cross-chain bridging protocol, paused its Core bridge on July 20 after an attacker drained roughly $1.65 million from its Solana liquidity pools. The incident, confirmed by blockchain security firms PeckShield and CertiK, was classified as a flash loan exploit. The move left users unable to move assets across the bridge for hours, with no clear timeline for reopening.
How the flash loan attack worked
Flash loans let a borrower take out a large, uncollateralized loan – as long as it's repaid within the same transaction. The attacker used that mechanism to manipulate the price of a token pair on Allbridge's Solana pool, then withdrew the difference before the system could rebalance. The exploit netted about $1.65 million in drained funds, according to PeckShield's analysis.
Flash loan attacks on bridges aren't new. But they keep working because the logic that calculates token prices during a swap is often vulnerable to rapid, large-scale manipulation. Allbridge's Core bridge – the one hit – is the protocol's main asset transfer layer.
Allbridge's response and the fallout
Within hours of the exploit, Allbridge's team paused the Core bridge. The move stopped further withdrawals and effectively froze any cross-chain transfers. The protocol hasn't said whether it will reimburse affected users or if it plans to relaunch the bridge with new safeguards.
Security firms CertiK and PeckShield both flagged the incident publicly, adding pressure on Allbridge to provide a detailed post-mortem. So far, the team has only confirmed the pause and said they're investigating.
What this means for users
Anyone who had funds stuck on the Solana side of the bridge couldn't move them to other chains for about six hours. The bridge was paused late on July 20 and remained offline into the next day. Allbridge's official channels have been quiet on a recovery plan.
For users who regularly bridge assets through Allbridge, this is the second notable incident this year – the protocol suffered a similar exploit in April 2023 that cost around $500,000. The repeated pattern raises questions about the security of its core contracts.
Allbridge hasn't set a deadline for when it will issue a full report or resume operations. Users are left waiting for clarity on whether their funds are safe and when the bridge will reopen.
