Allbridge pauses its Core bridge after flash loan exploit

Allbridge paused its Core cross-chain bridge after an attacker extracted about $1.65 million from stablecoin liquidity pools on Solana. The attacker borrowed $1.12 million in USDC from the lending protocol Kamino, swapped USDC and USDT in rapid succession to distort the pools' internal ratios, withdrew liquidity at the resulting favourable rate, and repaid the loan inside a single transaction.

The pattern is not new to Allbridge. A near-identical flash loan attack drained roughly $573,000 from its BNB Chain pools in April 2023, after which the protocol reworked how it calculates liquidity and withdrawals. This exploit hit a USDC and USDT pool running side by side on Solana, the multi-stablecoin configuration that the earlier fix was meant to remove.

Allbridge suspended the protocol pending investigation, advised liquidity providers to withdraw and asked traders who profited from the imbalance to return funds.

A fix scoped to the chain where a bug was found rather than to the class of bug leaves the same arithmetic exposed wherever the old configuration survives.