Allbridge Core hacked for $1.65 million via Solana exploit

The cross-chain bridge protocol Allbridge Core has been temporarily halted after a serious security incident. Attackers managed to steal approximately $1.65 million through a sophisticated flash loan construction on Solana, after which the stolen funds moved to Ethereum. Users with liquidity in the affected pools are strongly advised to withdraw their funds as soon as possible.

How the Attack Works

Blockchain security firm PeckShield states that the attacker, using a flash loan of $1.12 million in USDC borrowed via the Kamino protocol on Solana, managed to manipulate the ratio in the USDC/USDT liquidity pool. By artificially distorting this ratio, the attacker could then withdraw liquidity at manipulated rates, resulting in a total loot of $1.65 million.

After the attack on Solana, the attacker bridged the stolen funds to Ethereum, which at the time of writing is trading at $1.900, down 0.8% over the past 24 hours. This type of attack, where a pool ratio is temporarily disrupted to profit from it, is a well-known method in the DeFi landscape. More on similar hacks and attacks in crypto can be found on our overview page.

Allbridge Asks Arbitrageurs to Return Funds

In addition to the direct attack, the pool imbalance also created a temporary positive arbitrage window. Allbridge is now also addressing those who profited from that situation, kindly asking them to return the collected funds to a specified address. That money will go directly to the affected liquidity providers, also known as LPs.

The team says it is investigating the matter and has paused the protocol as a precautionary measure in the meantime. There is no official update yet on when Allbridge Core will be operational again. The situation surrounding stablecoins such as USDC and USDT in DeFi protocols therefore remains a point of attention, especially now that this type of attack via flash loans is becoming increasingly common.