Allbridge Core has paused its cross-chain stablecoin protocol after an attacker stole about $1.65 million from their Solana liquidity pools, according to security firms CertiK and PeckShield.
Allbridge is a bridge that lets users move assets between blockchains that don’t communicate directly. Its core product uses liquidity pools to transfer native stablecoins such as USDC and USDT without issuing wrapped versions of the assets.
The attacker used a $1.12 million flash loan from Solana lending protocol Kamino to rapidly exchange USDC and USDT, manipulating the pools’ internal ratios before raising assets at favorable prices, according to Onchain Lens. A flash loan is a loan that is taken out and repaid within the same transaction.
The stolen assets were linked to an Ethereum address and spread over additional addresses. It is currently not clear how much remains under the attacker’s control.
Allbridge said it paused the protocol while it investigated and told liquidity providers to withdraw from affected pools. The initial manipulation left the pools unbalanced and created a temporary arbitrage opportunity. Allbridge asked dealers who profited from the price distortion to return funds for LP compensation.
Allbridge was hit by a similar flash loan attack in 2023 that drained around $650,000 from its BNB Chain pools. The firm later said it recovered most of the funds and changed its liquidity and withdrawal calculations. Allbridge had raised $2 million in 2022 to expand the bridge and fund safety audits.
