Overview
- On-chain analysts say an attacker used a roughly $1.12 million USDC flash loan on Solana to warp an Allbridge USDC/USDT pool, withdraw liquidity at distorted rates, bridge the proceeds to Ethereum, and swap them into ETH.
- Allbridge paused its Core protocol and posted a public warning urging liquidity providers to withdraw from affected pools and asking anyone who profited to return funds to a designated recovery address.
- Estimates of the theft differ across forensics teams, with Onchain Lens reporting just over $1.1 million taken and PeckShield and others estimating about $1.65 million, and investigators say the total remains under review.
- On-chain intelligence firms including Arkham, PeckShield and Onchain Lens are actively tracing the attacker’s cross-chain wallet movements because any deposit to a centralized exchange could enable a freeze and potential recovery.
- The incident follows a string of 2026 bridge exploits and echoes Allbridge’s 2023 flash-loan loss that was largely recovered through a white-hat arrangement, underscoring persistent risks in cross-chain pool design and direct harm to liquidity providers.