Allbridge Pauses Cross-Chain Protocol After $1.65M Flash Loan Attack – Decrypt

Cross-chain bridge Allbridge has paused its protocol after an attacker drained roughly $1.65 million from its Solana liquidity swimming pools in a flash mortgage assault, in accordance with blockchain safety corporations and the mission itself.

Allbridge lets customers transfer belongings between blockchains that do not natively talk, and its Core product makes use of swimming pools of native stablecoins comparable to USDC and USDT fairly than minting wrapped tokens. On Sunday, the crew stated it had “paused the protocol as a precaution” whereas investigating, and urged liquidity suppliers to tug funds from affected swimming pools.

In a follow-up tweet, Allbridge famous that its crew was “getting ready an in depth breakdown” and autopsy report, including that “There isn’t a menace to customers liquidity proper now” as it really works to relaunch Core with out liquidity swimming pools.

The way it occurred

Allbridge confirmed an earlier tweet from safety agency PeckShield placing the loss at round $1.65 million, which famous that the attacker had bridged the funds from Solana to Ethereum.

Fellow agency CertiK detailed the tactic, which noticed the attacker borrow $1.12 million via a flash mortgage from Solana lending protocol Kamino, earlier than operating a speedy collection of stablecoin swaps to distort the inner accounting that costs belongings in Allbridge’s swimming pools.

With the swimming pools mispriced, the attacker swapped a number of thousand {dollars} of USDT for about $2.24 million in USDC earlier than bridging the proceeds to an Ethereum deal with and scattering them throughout others. It is not clear how a lot stays inside attain.

The manipulation left Allbridge’s swimming pools lopsided, briefly letting different merchants purchase up the mispriced belongings—a “non permanent constructive arbitrage window,” because the crew put it. The DeFi platform requested anybody who profited from that window to ship the cash to a chosen deal with, saying it might “go immediately towards compensating affected LPs.” Its “purpose is to return all affected funds,” the crew added.

Not the primary time

It is the second time Allbridge has been caught this fashion. In April 2023, an analogous flash-loan exploit drained round $573,000 from its BNB Chain swimming pools; the mission later stated it recovered many of the funds and reworked the way it calculates liquidity and withdrawals. Allbridge raised $2 million in 2022 to increase the bridge and fund safety audits.

Bridges and the liquidity swimming pools that feed them have lengthy been amongst DeFi’s most-targeted infrastructure. Greater than $840 million was misplaced to DeFi hacks in simply the primary 5 months of 2026, with cross-chain techniques repeatedly producing a number of the largest single losses. Simply final month, a bridge between Axelar and Secret Community was drained of $4.67 million after attackers exploited an “infinite mint” bug in a customized token contract.

Allbridge’s protocol stays paused, and the way a lot of the $1.65 million may be clawed again will hinge on tracing the bridged funds—and on whether or not the arbitrage merchants it appealed to really ship the cash again.