Allbridge Core has paused its cross-chain stablecoin protocol after an attacker stole approximately $1.65 million from its Solana liquidity pools, according to security firms CertiK and PeckShield.
Allbridge is a bridge that allows users to move assets between blockchains that do not communicate directly. Its Core product uses liquidity pools to transfer native stablecoins like USDC and USDT without issuing packaged versions of the assets.
The attacker used a $1.12 million flash loan from Solana’s lending protocol, Kamino, to quickly swap USDC and USDT, manipulating the pools’ internal ratios before withdrawing assets at favorable rates, according to Onchain Lens. A quick loan is a loan obtained and repaid in the same transaction.
The stolen assets were connected to one Ethereum address and dispersed to additional addresses. It is currently unclear how much remains under the attacker’s control.
Allbridge said it paused the protocol while it investigated and told liquidity providers to withdraw from the affected pools. The initial manipulation left the pools unbalanced and created a temporary arbitrage opportunity. Allbridge asked traders who benefited from the price distortion to return funds to compensate the LP.
Allbridge suffered a similar flash loan attack in 2023 that drained approximately $650,000 of its funds from the BNB chain. The company later said it recovered most of the funds and changed its liquidity and withdrawal calculations. Allbridge had raised $2 million in 2022 to widen the bridge and fund safety audits.
