Allbridge Core pauses protocol after $1.65 million flash loan exploit: onchain analysts

Cross-chain bridge Allbridge Core has been exploited for roughly $1.65 million, as flagged by multiple blockchain security firms, and the team has paused the protocol for investigation.

According to blockchain analysis provider Onchain Lens, the exploiter used a $1.12 million flash loan from Solana-based liquidity protocol Kamino to manipulate the stablecoin liquidity pool ratios by rapidly swapping USDC for USDT. The attacker then withdrew funds at favorable rates and routed the stolen assets through privacy protocols to obscure their trail.

Both PeckShield and CertiK reported Sunday that the attacker has bridged the stolen funds from Solana to Ethereum.

In a post on X, Allbridge said that it has paused the protocol and urged users to withdraw liquidity from affected pools. The team also noted that the resulting pool imbalance created a temporary positive arbitrage window.

"The resulting pool imbalance created a temporary positive arbitrage window. If you took advantage of it, please consider returning funds to the address below — this will go directly toward compensating affected LPs," the team said, adding that its goal is to "return all affected funds" to users.

In a follow-up statement posted to X, Allbridge confirmed that an attacker withdrew $1.65 million from Allbridge Core's liquidity pools and said a full report on the incident is being prepared.

The team said user liquidity faces no current threat and that Allbridge Next, its newer infrastructure, is operating normally. Allbridge added the exploit sped up a transition it had already begun, with Core and Allbridge Classic set to stop operating in their current form within three months as the protocol moves fully to Allbridge Next. The team urged liquidity providers to withdraw ahead of that wind-down.

A rebuilt Core will drop liquidity pools entirely, routing transfers through CCTP and LayerZero instead to remove the pool-imbalance risk that was exploited, according to the statement. "We are already working on relaunching Core without liquidity pools," the team said.

The Block has reached out to Allbridge for further comment.

Updated to include Allbridge official statement.