Key Takeaways:
- Allbridge Core was forced to halt its cross-chain bridge due to the flash-loan vulnerability, losing about $1.65 million.
- Attackers manipulated stablecoin pools before moving stolen funds from Solana to Ethereum.
- Allbridge is investigating and urged liquidity providers to withdraw from affected pools.
Yet another cross-chain bridge has fallen prey to a sophisticated DeFi exploit, underscoring the continued security problems in the realm of interoperability bridges. The financial loss may be relatively small compared to other big bridge hacks, though it is yet another reminder that flash loans are still a great way to take advantage of liquidity pool mechanics.
Allbridge Core is experiencing a security incident.
We have paused the protocol as a precaution while we investigate.If you have liquidity in affected pools, please withdraw now.
The resulting pool imbalance created a temporary positive arbitrage window. If you took advantage… pic.twitter.com/Ovg7yT35SM
— Allbridge (@Allbridge_io) July 19, 2026
Allbridge Halts Operations Following Flash Loan Attack
Cross-chain bridge Allbridge Core stopped its protocol after it was hacked and $1.65 million worth of stablecoins were drained from its infrastructure. The attack was spotted by several blockchain security companies, such as PeckShield and CertiK, soon after the incident and the protocol has temporarily halted activities as engineers work to understand the vulnerability.
The attacker first got a $1.12 million flash loan from lending protocol Kamino on Solana, according to on-chain investigators. The exploiter quickly exchanges all USDT and USDC in the pools, impacting the exchange rates of the pools in Allbridge. By manipulating the price, the attacker could sell assets at advantageous rates, and then buy back the same assets at the same transaction on the platform, paying at additional rates.
Read More: Taiko Bridge Hack Drains $1.7M
The stolen funds were later analyzed on the blockchain to determine that they were transferred from Solana to Ethereum, a common method of attackers wishing to increase their liquidity and find other ways to obscure funds.
Liquidity Providers Asked to Exit Affected Pools
After the hack, Allbridge urged liquidity providers to pull their money from affected pools, as the protocol’s security is still being reviewed. The attack caused an imbalance, it opened up profitable arbitrage opportunities for a short time for the team in the affected pools.
Interestingly, Allbridge encouraged traders who profited from this short term price imbalance to voluntarily repatriate any gains that they made in a public statement. As per the protocol, the recovered money would flow to affected liquidity providers during the course of the investigation.
The project has not yet published a full technical after-action report on the project as of the time of writing, nor has it announced when bridge services will be restored. The hacker path continues to be analysed by both developers and the security community.
Flash Loans Continue to Expose DeFi Weaknesses
Flash loan attacks are different from traditional hacks that involve using stolen private keys or hacking into infrastructure in their nature. Flash loans are uncollateralized and can only be paid back in a single transaction, allowing a flash-loan attack to rapidly access a large amount of liquidity to influence asset prices or calculations within the protocol.
This exploit seems to have been based on fast swaps to change the ratios of the stablecoin pools, rather than on the cryptography of the bridge. The separation is an example of the broader decentralized finance pricing conundrum: even the best-audited protocols can be susceptible when liquidity conditions or pricing assumptions are abused in extreme market situations.
Read More: Humanity Protocol Crashes 87%
