Allbridge Core Drained in $1.65 Million Exploit as Stolen Funds Move to Ethereum

Allbridge Core has become the latest cross-chain protocol to discover how quickly a liquidity imbalance can turn into a seven-figure loss. An attacker exploited the bridge’s Solana deployment for an estimated $1.65 million, moved the stolen assets from Solana to Ethereum and began routing the funds through mechanisms designed to make the trail more difficult to follow.

Allbridge paused its Core protocol while investigating the incident and urged liquidity providers with funds in the affected pools to withdraw. The company has not yet released a complete technical post-mortem, leaving security researchers and onchain analysts to reconstruct the attack from the transactions visible on Solana and Ethereum.

The early evidence points to a flash-loan-assisted manipulation of a stablecoin liquidity pool rather than a compromise of private keys or the bridge’s validator infrastructure. That distinction explains the mechanics of the attack, but it does little to reduce the consequences for liquidity providers whose capital was exposed to the distorted pool.

A Flash Loan Turned Liquidity Into a Weapon

According to initial analysis from Onchain Lens, the attacker borrowed approximately $1.12 million in USDC through a flash loan from Kamino, a Solana-based liquidity protocol.

A flash loan allows a user to borrow substantial capital without posting traditional collateral, provided that the loan is repaid within the same blockchain transaction. The feature is useful for legitimate arbitrage, refinancing and liquidity management. It also gives attackers access to enough temporary capital to manipulate markets that would otherwise be too expensive to influence.

In this case, the borrowed USDC was reportedly used to execute rapid swaps between USDC and USDT inside an Allbridge Core liquidity pool. Both assets are designed to trade close to one US dollar, but their exchange rate inside an automated pool depends on the pool’s reserves and pricing formula.

By pushing a large amount of capital through the pool in a carefully structured sequence, the attacker appears to have distorted the relationship between the two stablecoins. Once the pool was sufficiently imbalanced, assets could be withdrawn at an exchange rate that no longer reflected their real market value.

The attacker then repaid the flash loan while retaining the extracted value. Blockchain-security firms PeckShield and CertiK estimated the total loss at roughly $1.65 million.

The entire operation demonstrates why flash-loan attacks can be so effective. The attacker does not need to own the capital used to manipulate the pool. They only need to identify a pricing mechanism that can be pushed into an unsafe state and complete the full sequence before the transaction ends.

If any step fails, the transaction can revert and the borrowed funds return to the lender. If the exploit succeeds, the attacker repays the loan and keeps the difference.

Stolen Assets Crossed From Solana to Ethereum

After extracting the funds, the attacker reportedly bridged the stolen assets from Solana to Ethereum and converted them into ETH.

The move was strategically significant. Ethereum provides access to deeper liquidity, a larger collection of decentralized exchanges and a wider range of privacy tools. Moving the assets also complicates recovery efforts because investigators must follow the funds across multiple networks, bridge transactions, token conversions and potentially numerous wallet addresses.

Onchain analysts reported that some of the funds were subsequently directed toward privacy-oriented pools. These protocols can combine deposits from multiple users and make it more difficult to connect the original source of an asset with its eventual destination.

Blockchain transactions remain public, but public does not always mean easily attributable. Investigators can watch funds enter a privacy system without necessarily knowing where the same value later exits.

Speed is therefore critical after an exploit. Security teams may try to contact exchanges, stablecoin issuers, bridge operators and other infrastructure providers before the attacker can disperse the assets. Once the funds have been divided, swapped and routed through privacy services, the chances of a straightforward recovery decrease substantially.

The transfer to Ethereum does not mean the attacker has escaped detection. It does, however, suggest an effort to move beyond the environment where the exploit occurred and gain access to a broader set of laundering options.

Allbridge Pauses Core and Warns Liquidity Providers

Allbridge said it paused the protocol as a precaution while investigating the security incident. The team also told liquidity providers with funds in the affected pools to withdraw immediately.

That warning reflects a second layer of risk created by the exploit. Even after the attacker completes the main extraction, the damaged pool can remain severely imbalanced. Liquidity-provider positions may therefore no longer represent the asset composition or value that depositors originally expected.

Allbridge acknowledged that the imbalance temporarily created a profitable arbitrage opportunity. Traders who noticed the distorted pricing could exchange assets at favorable rates, potentially extracting additional value from the affected pool even without participating in the original exploit.

This creates a complicated recovery problem. Some transactions executed after the attack may have been ordinary arbitrage rather than malicious activity. From the pool’s perspective, however, both can deepen the losses experienced by liquidity providers.

Allbridge asked traders who benefited from the temporary arbitrage window to consider returning the proceeds, saying that recovered funds would be used to compensate affected LPs. The company stated that its objective is to return all affected funds to users.

Whether that is achievable will depend on how much capital can be recovered, the final size of the losses and the technical details revealed by the investigation.

For LPs, the immediate priority is not chasing yield or attempting to trade around the imbalance. It is following the protocol’s official instructions, withdrawing from affected pools where possible and avoiding further deposits until Allbridge has explained the vulnerability and completed its remediation process.

Why Stablecoin Pools Are Not Automatically Stable

The exploit also exposes a persistent misconception surrounding stablecoin liquidity.

USDC and USDT are both intended to maintain a value close to one dollar. That does not mean every exchange between them is protected from manipulation. A decentralized pool calculates prices according to its reserves and smart-contract logic, not according to a universal guarantee that one stablecoin must always equal another.

Stablecoin-focused automated market makers are typically designed to offer low-slippage trades when assets remain close to parity. The efficiency comes from specialized pricing curves that assume the tokens should trade within a narrow range.

That assumption can become dangerous if an attacker can artificially shift the pool’s reserves or exploit a weakness in the way deposits, withdrawals and swaps are calculated. A formula optimized for efficient stablecoin trading may behave unpredictably when subjected to a transaction sequence that its designers did not adequately anticipate.

The key question is not simply whether USDC and USDT remained close to one dollar on external markets. It is whether Allbridge Core’s internal accounting allowed the attacker to create and monetize a temporary discrepancy inside the protocol.

A full technical assessment will need to establish which checks failed, whether the vulnerability was specific to the Solana implementation and whether equivalent attack paths exist in any other Allbridge pools.

A Familiar Problem for Allbridge

This is not the first time Allbridge has faced a flash-loan-related security incident.

In April 2023, an attacker exploited an Allbridge liquidity pool on BNB Chain and drained approximately $573,000. That incident also involved manipulation of a stablecoin pool’s pricing mechanism. Part of the stolen money was later returned after the project offered the attacker an opportunity to act as a white-hat participant.

The similarity does not necessarily mean the same vulnerability survived unchanged for more than three years. The current exploit affected a different blockchain deployment and may involve separate code, assumptions or implementation details.

It does, however, place additional pressure on Allbridge to explain how the latest attack bypassed its defenses. Users will want to know what was changed after the 2023 incident, whether the new exploit shared any underlying design characteristics with the earlier attack and how the protocol plans to prevent a third occurrence.

Security reviews cannot focus only on previously identified lines of vulnerable code. They must also examine the broader economic conditions that made the exploit possible.

A contract can function exactly as written and still produce a catastrophic result if its pricing model, liquidity assumptions or transaction limits allow an attacker to manipulate the system profitably.

Cross-Chain Bridges Remain High-Value Targets

Cross-chain bridges occupy one of the most demanding positions in decentralized finance. They must coordinate assets and messages between networks that operate under different technical rules, while maintaining enough liquidity to make transfers practical.

That concentration of capital makes bridges attractive targets. Their complexity creates numerous places where security can fail, including smart contracts, liquidity pools, price calculations, message validation, privileged accounts and external dependencies.

The Allbridge incident appears to have targeted a liquidity mechanism rather than the bridge’s cross-chain verification system. Nevertheless, the attack reinforces the wider bridge-security problem: an attacker only needs to compromise one economically important component to place user funds at risk.

Audits remain necessary, but they cannot guarantee that every possible transaction sequence has been anticipated. Protocols also need active monitoring capable of detecting unusual pool imbalances, rapid high-value swaps and withdrawals that diverge sharply from normal activity.

Circuit breakers can help by automatically pausing activity when reserves move beyond predefined thresholds. Flash-loan-resistant pricing, withdrawal limits and time-weighted calculations can also reduce the ability of an attacker to create and exploit a temporary price distortion within a single transaction.

These defenses introduce trade-offs. Limits can make markets less efficient, pauses can interfere with legitimate users and slower pricing mechanisms may create other forms of risk. The alternative, however, is a system optimized for speed during normal conditions but unable to defend itself when capital arrives specifically to break its assumptions.

The Investigation Will Determine the Real Damage

The current $1.65 million figure is an estimate from blockchain-security analysts rather than a final loss calculation from Allbridge. The amount could change as investigators distinguish the original extraction from subsequent arbitrage, trace remaining funds and examine the exact condition of affected LP positions.

Allbridge’s next updates will need to address more than the status of the stolen assets. Liquidity providers will expect a clear accounting of losses, a compensation framework and an explanation of which pools were affected.

The protocol will also need to describe how it intends to restore operations safely. Reopening without a detailed diagnosis would leave users dependent on assurances rather than evidence.

A credible recovery process should include a technical post-mortem, independent review of the fix and a clear explanation of the safeguards added to detect similar manipulation. The company’s decision to pause the protocol limits immediate exposure, but the long-term test will be whether the incident leads to a stronger design.

For now, the message to affected liquidity providers is direct: withdraw from the impacted pools and wait for verified information from Allbridge before returning capital.

The attacker has already moved quickly. Allbridge’s challenge is to ensure its investigation is just as decisive—and considerably more transparent.