Overview
- The exploit, which occurred over the weekend, drained stablecoins from Allbridge Core’s Solana pools and forced the protocol to pause while teams investigate.
- On-chain analysts say the attacker took a $1.12 million USDC flash loan from Kamino, executed rapid USDC/USDT swaps to distort pool pricing, withdrew liquidity at the manipulated rate, and repaid the loan in the same transaction.
- Estimates of the loss vary across security firms with Onchain Lens reporting more than $1.1 million extracted and PeckShield, CertiK and multiple outlets placing the figure around $1.65 million.
- Allbridge urged liquidity providers to withdraw from affected pools and asked traders who profited from the temporary arbitrage to return gains for LP compensation, but it has not released a technical post‑mortem or said when Core will reopen.
- Security firms including PeckShield, CertiK, Arkham and Onchain Lens are tracing addresses as stolen funds were bridged to Ethereum and converted, a pattern that highlights persistent flash‑loan and pool‑pricing risks for cross‑chain bridges.