Allbridge, the company behind the cross-chain stablecoin bridge Allbridge Core, has temporarily paused the protocol after a reported security incident drained $1.65 million on Sunday. The disruption specifically impacted Allbridge Core’s Solana deployment, while the attacker reportedly moved the stolen funds onward to Ethereum and then into privacy-oriented pools.

In a post on X, Allbridge said it paused the protocol “as a precaution” while it investigates and urged users to withdraw liquidity from any affected pools. The episode adds to a growing list of cross-chain bridge exploits earlier this year, highlighting how attackers continue to target bridge-controlled liquidity that can become valuable once manipulated.

Key takeaways

• Allbridge Core paused operations after a $1.65 million reported incident affecting its Solana deployment.
• The attacker allegedly bridged funds from Solana to Ethereum before moving them into privacy pools, according to monitoring reports shared on X.
• Onchain analysis reported the use of a $1.12 million USDC flash loan to distort stablecoin pool pricing.
• Allbridge previously faced a flash-loan related exploit on BNB Chain in 2023, underscoring a recurring risk pattern in bridge liquidity pools.
• This incident follows multiple bridge attacks since May, reinforcing that cross-chain liquidity remains a persistent target for criminals.

Protocol pause after Solana-to-Ethereum theft

Allbridge Core’s pause was prompted by what the company described as a “security incident.” According to Allbridge’s statement on X, the protocol was stopped as a precaution while the team investigates and assesses exposure.

The company specifically advised: if users have liquidity in impacted pools, they should withdraw. That kind of guidance is typical after bridge-related exploits because the attacker’s impact can extend beyond the initial theft—particularly if pool pricing was manipulated and remaining liquidity becomes temporarily mispriced.

Monitoring information shared publicly points to a fast-moving sequence. An alert posted by CertiKAlert indicated the funds were already bridged from Solana to Ethereum after the incident, before the attacker reportedly routed value into privacy pools.

How the attacker reportedly manipulated stablecoin liquidity

Onchain Lens reported a detailed mechanism behind the event: the attacker allegedly took a $1.12 million USDC flash loan from Kamino, then executed rapid USDC/USDT swaps that disrupted the Allbridge Core stablecoin pool’s exchange rate.

Those trades reportedly created a window where the pool imbalance could be exploited. The attacker then withdrew liquidity at rates distorted by the manipulation, repaying the original flash loan and keeping the difference between what was withdrawn and what was effectively required to settle the loan.

Allbridge later referred to the outcome in its own communications. The company said the “pool imbalance created a temporary positive arbitrage window” and added that anyone who benefited should consider returning funds. It also stated returned value would go toward compensating affected liquidity providers.

For investors and traders, the practical takeaway is that bridge exploits are not only about the amount ultimately stolen. Price distortion and temporary arbitrage dynamics can lead to secondary effects—such as losses for liquidity providers who remain exposed after the initial manipulation, unless the protocol is paused and withdrawal guidance is followed.

A flash-loan pattern tied to recurring bridge vulnerabilities

This was not the first time Allbridge Core faced flash-loan style pressure. The company and its infrastructure have been hit before: in April 2023, Allbridge was exploited on the BNB Chain via a flash loan against a pool there, according to a technical analysis published by SolidityScan.

That earlier incident reportedly involved an attacker acting as both liquidity provider and swapper while exploiting business logic in a smart contract. The mechanism allowed the attacker to manipulate swap prices, which led to reported drains of $289,900 in BUSD and $290,900 in USDt.

While each bridge deployment and asset routing can differ, the continuity in tactics—flash loans combined with liquidity pool price manipulation—signals a broader vulnerability class. In many cross-chain designs, bridges rely on liquidity pools to support issuance and redemption of bridged assets. If pool accounting and swap logic can be influenced within a single transaction sequence, attackers may generate profit without needing long-term capital exposure.

The near-term uncertainty for users is how thoroughly Allbridge Core investigated the precise smart contract paths involved on Solana and whether any additional pools—or liquidity routes—were affected beyond the reported $1.65 million figure.

Cross-chain bridges targeted since May

This Allbridge Core incident lands in the middle of a broader streak of reported bridge attacks. Earlier coverage from Cointelegraph detailed how multiple protocols urged user withdrawals or paused bridge services following exploits, reflecting how quickly damage can spread when attackers identify liquidity weaknesses.

In June, Cointelegraph reported that Taiko, an Ethereum layer-2 network, urged users to withdraw assets after attackers exploited one of its bridge protocols and stole $1.7 million. Taiko later reopened its bridge 11 days later after completing a four-step recovery plan.

Weeks before that, Cointelegraph reported that Secret Network was exploited via an “infinite mint” bug in a vulnerable smart contract. That incident reportedly resulted in $4.67 million in unbacked Axelar-wrapped assets.

Other bridge failures mentioned in recent reporting include Cointelegraph’s reports on the Gravity Bridge halting after a reported $54 million exploit, the Verus Bridge reportedly being exploited for millions, and Butter Network losing most of its value after a reported quadrillion token mint exploit.

Taken together, the pattern is consistent: bridge systems concentrate liquidity, and that liquidity often translates into high payoff for attackers who can manipulate pricing, mint/burn mechanics, or settlement logic across chains. When protocols respond with pauses and user-withdrawal instructions, they are effectively trying to limit further exposure while remediation work is underway.

For users, the next watchpoints are straightforward: whether Allbridge Core confirms the full scope of affected pools, when the protocol restarts (if it does), and what safeguards are described in the aftermath—especially around pool invariants and flash-loan-resistance. Until those details are clear, liquidity providers should assume that temporary pricing distortions may not fully resolve without an operational pause.

South Korea’s Financial Services Commission (FSC) says it has investigated more than 40 cases of alleged unfair trading involving digital-asset markets over the past two years, ranging from market manipulation to fraudulent crypto trading.

In a post on X, FSC Chair Lee Eog-won reported that 30 of the cases were referred to investigative bodies or reported for further action. He also said the commission identified 25 suspects after the Virtual Asset User Protection Act took effect in July 2024.

Key takeaways

• FSC investigations covered more than 40 unfair trading cases across the past two years, including suspected manipulation and fraud.
• After the Virtual Asset User Protection Act began in July 2024, Lee said the FSC identified 25 suspects and referred or reported 30 cases.
• Lee estimated average unlawful gains at about 1.4 billion won (roughly $940,000) per case.
• The law requires crypto service providers to separate customer deposits and holdings from company assets, with client funds kept in banks.
• South Korea plans to keep expanding AI-assisted surveillance and concentrate on “high-risk areas.”

What the FSC says it has uncovered

Lee Eog-won’s update frames the investigations as a step toward bringing previously less-regulated digital-asset activity under stronger oversight. According to his account, the FSC investigated “more than 40 cases” of alleged unfair trading such as market manipulation and fraudulent trading behavior within the last two years.

Lee added that, within that set of matters, 30 cases were reported or referred to investigative agencies. He linked the period after July 2024—when the Virtual Asset User Protection Act began—to a more structured enforcement pipeline, saying 25 suspects were identified following the law’s implementation.

He also provided an estimate for enforcement economics: average unlawful gains were around 1.4 billion Korean won (about $940,000). While the figure doesn’t break down how gains were calculated in each case, it underlines the FSC’s message that the alleged violations were financially material, not merely technical rule breaches.

How the Virtual Asset User Protection Act changes enforcement

The Virtual Asset User Protection Act is designed to protect users who buy or store crypto assets through regulated virtual asset service providers (VASPs). In practical terms, the FSC highlighted that VASPs must segregate customer deposits and virtual assets from their own corporate holdings.

Under the framework Lee referenced, client deposits are held in banks rather than being commingled with the provider’s own funds. This structure is intended to reduce the risk that customer assets are impaired or diverted if a firm faces operational or financial stress.

The law also targets trading misconduct such as insider trading, wash trading, and market manipulation. Importantly for market participants, the FSC’s role extends beyond licensing and basic compliance: the commission can supervise and inspect VASPs more directly, giving it a clearer enforcement mandate tied to specific categories of prohibited conduct.

Surveillance and AI monitoring—what Lee says will come next

Beyond prosecution and referrals, the FSC chair indicated a continued push to upgrade the monitoring systems used to detect wrongdoing. Lee said the FSC will enhance market surveillance investigation and monitoring systems “based on AI,” and will respond proactively to “high-risk areas.”

That language suggests authorities plan to refine detection for patterns associated with manipulation and other unfair trading tactics, rather than relying solely on post-event investigations. For traders and compliance teams, the key implication is that automated or AI-assisted tools may increasingly shape which activities are flagged, investigated, and escalated for enforcement.

It is also notable that Lee’s update ties enforcement activity to a legal milestone: the second anniversary of the user protection legislation. The emphasis on surveillance capacity—rather than only outcomes—points to an enforcement strategy that seeks earlier identification of misconduct, which can affect how VASPs structure compliance controls and how quickly suspicious behavior is escalated.

Why these enforcement numbers matter to the market

The FSC’s figures—more than 40 investigated cases over two years, with 30 referred or reported and 25 suspects identified after the July 2024 start—serve as a signal to South Korea’s crypto ecosystem that regulatory scrutiny is not limited to paperwork or isolated cases.

For investors, the segregation requirements described by Lee are intended to improve the safety of customer funds. For VASPs, the shift is both operational and reputational: firms must demonstrate that they can comply with asset separation rules while also meeting expectations around market integrity and monitoring.

For traders, the reference to insider trading, wash trading, and market manipulation matters because it underscores that the regulator is actively focused on the mechanics of trading—not just the availability of crypto services. As AI monitoring expands, the compliance burden may increasingly include data-driven controls and more robust reporting processes designed to reduce the risk of violations that authorities can detect and pursue.

Related coverage: South Korea to bring digital assets under new state asset management system.

Going forward, investors and market operators should watch whether the FSC’s AI-assisted surveillance results in a higher rate of referrals and sanctions tied specifically to the law’s protected-user requirements and trading-integrity rules, and whether the average unlawful gains figure is followed by more detailed breakdowns that clarify how investigators assess proceeds and harm.

Allbridge Core, a cross-chain stablecoin bridge, said it has paused the protocol as a precaution after a “security incident” that reportedly saw $1.65 million drained on Sunday.

The incident affected Allbridge Core’s Solana deployment, with the attacker having already bridged the stolen funds from Solana to Ethereum before moving them into privacy pools. 

“Allbridge Core is experiencing a security incident,” it said in a post on X on Sunday. “We have paused the protocol as a precaution while we investigate. If you have liquidity in affected pools, please withdraw now.” 

The Allbridge Core exploit is at least the sixth attack targeting a cross-chain bridge since May. Bridges are attractive targets for attackers because they often hold large pools of funds that back bridged assets on the destination blockchain. 

Source: Lookonchain

Onchain Lens reported the attacker made a $1.12 million USDC (USDC) flash loan from Kamino, before rapid USDC/USDT swaps that distorted the Allbridge Core stablecoin pool’s exchange rate. 

Related: Taiko reopens bridge after $1.7M exploit, says users made whole 

The attacker then withdrew liquidity at manipulated rates, repaying the $1.12 million USDC loan and keeping the difference. 

“The resulting pool imbalance created a temporary positive arbitrage window. If you took advantage of it, please consider returning funds… this will go directly toward compensating affected LPs,” it added.

This wasn’t the first time Allbridge Core was hit by a flash loan attack.

In April 2023. Allbridge was exploited for $573,000 through a flash loan attack on Allbridge’s pool on the BNB Chain. The attacker acted as both liquidity provider and swapper, and exploited a flaw in a smart contract that allowed them to manipulate swap prices, which led to $289,900 drained in Binance USD (BUSD) and $290,900 in USDt (USDT).

Warning posted to the Allbridge Core website. Source: Allbridge Core

Cross-chain bridges targeted since May 

In June, Taiko, an Ethereum layer-2 blockchain, urged its users to withdraw assets from the network’s bridges after attackers exploited one of its bridge protocols and stole $1.7 million. 

Taiko reopened its bridge 11 days later after completing a four-step recovery plan. 

Weeks before the Taiko incident, Secret Network was exploited through an “infinite mint” bug on a vulnerable smart contract, which created unbacked versions of Axelar-wrapped assets, resulting in a $4.67 million exploit.  

Other recent bridge exploits included the Gravity Bridge, Verus Bridge and the Butter Network. 

Magazine: The British Virgin Islands are a top crypto hub no one ever talks about: Here’s why