Allbridge Core has paused its cross-chain stablecoin protocol after a security incident on Solana that PeckShield estimated at about $1.65 million. 

The protocol told users with funds in affected liquidity pools to withdraw while its team investigates. PeckShield also said the attacker moved the stolen assets from Solana to Ethereum.

The incident appears to involve manipulation of Allbridge Core’s USDC/USDT liquidity pool. Onchain Lens said the attacker used a $1.12 million USDC flash loan from Kamino, changed the pool balance through rapid swaps and withdrew liquidity at distorted rates. The exact loss figure remains under review, with Onchain Lens describing more than $1.1 million extracted and PeckShield estimating the broader exploit at about $1.65 million.

Allbridge pauses Core and warns liquidity providers

“Allbridge Core is experiencing a security incident,” the team said in its public notice. It added that the protocol had been paused as a precaution while the investigation continued. The project also issued a direct warning: “If you have liquidity in affected pools, please withdraw now.”

Allbridge said the attack left some pools temporarily out of balance. That imbalance created an arbitrage window that allowed some traders to profit from unusual pricing. The team asked anyone who benefited to consider returning funds to a recovery address. It said returned assets would go toward compensating affected liquidity providers. At the time of writing, the notice did not give a reopening date or publish a technical report.

In addition, according to Onchain Lens, the attacker borrowed $1.12 million in USDC through a flash loan from Kamino. The attacker then carried out rapid USDC and USDT swaps that changed the ratio inside the Allbridge stablecoin pool. After the pool price moved, the attacker withdrew liquidity using the distorted rate and repaid the flash loan within the same transaction.

Flash loans allow users to borrow and repay funds in one blockchain transaction without posting normal collateral. In this case, the loan itself was not described as the vulnerability. Instead, the borrowed liquidity allegedly gave the attacker enough capital to move the pool ratio and extract value before the transaction ended. PeckShield later said the stolen funds were bridged from Solana to Ethereum.

Allbridge faces another bridge security incident

The latest Allbridge Core exploit follows an earlier attack against the project. As crypto.news previously reported, Allbridge suffered a separate exploit in April 2023 after an attacker manipulated the swap price of a BNB Chain pool. The loss was estimated at about $573,000, and the project later recovered roughly $465,000 after offering the attacker a white-hat reward.

The new incident also comes during another active period for cross-chain security breaches. In May,the Verus-Ethereum bridge lost more than $11.5 million in an attack linked by researchers to missing validation checks. A separate crypto.news report said Transit Finance lost about $1.88 million in another cross-chain protocol exploit. Allbridge has not said whether the Solana incident shares technical similarities with those attacks.

Allbridge, the firm behind the cross-chain stablecoin bridge Allbridge Core, has paused its protocol after a reported security incident on Sunday that investigators and on-chain analysts say resulted in roughly $1.65 million being drained. The company said the pause is a precaution while it investigates, and it urged users with liquidity in impacted pools to withdraw.

According to Allbridge Core’s own announcement on X, the exploit affected Allbridge Core’s deployment on Solana. Monitoring accounts cited in the incident also claim the attacker moved funds from Solana to Ethereum and then funneled proceeds into privacy-related pools, illustrating how quickly bridge exploits can turn into multi-chain extraction events.

Key takeaways

• Allbridge Core has paused its protocol following a reported cross-chain stablecoin bridge incident affecting its Solana deployment.
• The incident reportedly involved ~$1.65 million drained, with on-chain monitoring suggesting the attacker bridged funds from Solana to Ethereum.
• Liquidity providers were urged to withdraw from affected pools to limit exposure while the team investigates.
• On-chain analysis points to a flash-loan and rate-manipulation pattern that allowed the attacker to profit from a temporary pool imbalance.
• Bridge exploits are recurring: multiple reported attacks have hit different bridge systems since May, highlighting structural risk across the sector.

Allbridge Core pauses after Sunday incident

Allbridge said in a Sunday post on X that Allbridge Core was “experiencing a security incident” and that it had paused the protocol while it investigates. The firm added a direct instruction to users: if they have liquidity in affected pools, they should withdraw immediately.

The breach was reported to involve Allbridge Core’s Solana deployment. CertiKAlert later posted that the stolen funds had already been bridged from Solana to Ethereum before moving into privacy pools, according to the monitoring thread referenced by reporting shared on social media.

While the company did not provide additional technical details in the initial communication, the operational response—pausing the protocol and prompting LP withdrawals—suggests that Allbridge recognized ongoing risk rather than treating the event as a fully contained, already-resolved failure.

What on-chain reports say happened

On-chain analytics highlighted a specific mechanism consistent with recent DeFi bridge exploitation patterns. According to Onchain Lens, the attacker made a $1.12 million USDC flash loan from Kamino. The attacker then used rapid USDC/USDT swaps to distort the exchange rate inside the Allbridge Core stablecoin pool.

The same reporting indicates the attacker took advantage of the manipulated pricing by withdrawing liquidity at unfavorable-to-others rates. After extracting the difference created by the temporary imbalance, the attacker reportedly repaid the flash loan and retained the profit from the rate disruption.

Allbridge Core’s own follow-up language, as reflected in the incident discussion, referenced a “pool imbalance” that created a “temporary positive arbitrage window.” The company also suggested that if anyone took advantage of the window, they should consider returning funds, with any returned amounts intended to support compensation for affected liquidity providers.

Why this kind of bridge attack keeps repeating

This incident did not occur in isolation. The reporting notes that it is at least the sixth attack targeting a cross-chain bridge since May. Bridges are frequently attacked because they manage large pools of assets across networks—assets that back bridged tokens on the destination chain. If an attacker can manipulate pricing, liquidity, or settlement logic, the bridge’s pooled reserves can amplify losses.

In practice, these attacks often combine speed (to exploit temporary state changes) with cross-chain movement (to break the attacker’s funds away from any single environment). Sunday’s event appears to align with that playbook: on-chain monitoring suggested stolen value moved from Solana to Ethereum before being moved into privacy pools, underscoring the challenge for recovery once funds change hands across chains.

The case also highlights a persistent tension for investors and LPs: even when bridge designs rely on liquidity pools and token accounting rather than direct custodian control, attackers can still reach profit by exploiting assumptions around swap paths, price discovery, and pool invariants—especially when flash loans are available.

Allbridge Core isn’t new to flash-loan style exploits

Allbridge Core’s Sunday incident is not the company’s first exposure to flash-loan-driven manipulation. Earlier coverage and related documentation indicate that in April 2023 Allbridge was exploited for about $573,000 through a flash loan attack on Allbridge’s pool on BNB Chain.

That earlier event, as described in an analysis of the hack, involved an attacker acting as both liquidity provider and swapper, exploiting a flaw in smart contract logic that allowed them to manipulate swap prices. The outcome included drains denominated in BUSD and USDt, totaling roughly $573,000 based on the figures cited in the underlying analysis.

With Sunday’s report pointing to a similar exploitation pattern—flash loan funding, fast swaps, pool imbalance, then liquidity withdrawals—the renewed incident raises a practical question for LPs: even if a team responds by pausing the protocol, what controls exist to prevent the same class of risk from reappearing under different market conditions or on different deployments?

Cross-chain bridge attacks remain a sector-wide problem

Broader reporting shows that cross-chain bridges have faced repeated pressure from exploits across multiple ecosystems in recent months. In June, for example, Taiko urged users to withdraw assets from its bridges after a $1.7 million exploit, later reopening its bridge 11 days after completing a recovery plan. Weeks earlier, Secret Network was reportedly exploited through an “infinite mint” bug that created unbacked versions of Axelar-wrapped assets, resulting in a $4.67 million incident. Other widely reported bridge failures included Gravity Bridge, Verus Bridge, and Butter Network.

Together, these cases reinforce an important takeaway for anyone using or providing liquidity to bridge-related systems: cross-chain infrastructure concentrates both technical complexity and financial value, and the attack surface expands as protocols integrate multiple chains, wallets, swap venues, and liquidity mechanisms.

Readers should watch closely for two things next: whether Allbridge Core can determine the full scope of the impacted liquidity pools on Solana and any related deployments, and whether the team’s investigation leads to specific changes that reduce the likelihood of similar flash-loan-driven pool imbalances recurring.

Allbridge, the company behind the cross-chain stablecoin bridge Allbridge Core, has temporarily paused the protocol after a reported security incident drained $1.65 million on Sunday. The disruption specifically impacted Allbridge Core’s Solana deployment, while the attacker reportedly moved the stolen funds onward to Ethereum and then into privacy-oriented pools.

In a post on X, Allbridge said it paused the protocol “as a precaution” while it investigates and urged users to withdraw liquidity from any affected pools. The episode adds to a growing list of cross-chain bridge exploits earlier this year, highlighting how attackers continue to target bridge-controlled liquidity that can become valuable once manipulated.

Key takeaways

• Allbridge Core paused operations after a $1.65 million reported incident affecting its Solana deployment.
• The attacker allegedly bridged funds from Solana to Ethereum before moving them into privacy pools, according to monitoring reports shared on X.
• Onchain analysis reported the use of a $1.12 million USDC flash loan to distort stablecoin pool pricing.
• Allbridge previously faced a flash-loan related exploit on BNB Chain in 2023, underscoring a recurring risk pattern in bridge liquidity pools.
• This incident follows multiple bridge attacks since May, reinforcing that cross-chain liquidity remains a persistent target for criminals.

Protocol pause after Solana-to-Ethereum theft

Allbridge Core’s pause was prompted by what the company described as a “security incident.” According to Allbridge’s statement on X, the protocol was stopped as a precaution while the team investigates and assesses exposure.

The company specifically advised: if users have liquidity in impacted pools, they should withdraw. That kind of guidance is typical after bridge-related exploits because the attacker’s impact can extend beyond the initial theft—particularly if pool pricing was manipulated and remaining liquidity becomes temporarily mispriced.

Monitoring information shared publicly points to a fast-moving sequence. An alert posted by CertiKAlert indicated the funds were already bridged from Solana to Ethereum after the incident, before the attacker reportedly routed value into privacy pools.

How the attacker reportedly manipulated stablecoin liquidity

Onchain Lens reported a detailed mechanism behind the event: the attacker allegedly took a $1.12 million USDC flash loan from Kamino, then executed rapid USDC/USDT swaps that disrupted the Allbridge Core stablecoin pool’s exchange rate.

Those trades reportedly created a window where the pool imbalance could be exploited. The attacker then withdrew liquidity at rates distorted by the manipulation, repaying the original flash loan and keeping the difference between what was withdrawn and what was effectively required to settle the loan.

Allbridge later referred to the outcome in its own communications. The company said the “pool imbalance created a temporary positive arbitrage window” and added that anyone who benefited should consider returning funds. It also stated returned value would go toward compensating affected liquidity providers.

For investors and traders, the practical takeaway is that bridge exploits are not only about the amount ultimately stolen. Price distortion and temporary arbitrage dynamics can lead to secondary effects—such as losses for liquidity providers who remain exposed after the initial manipulation, unless the protocol is paused and withdrawal guidance is followed.

A flash-loan pattern tied to recurring bridge vulnerabilities

This was not the first time Allbridge Core faced flash-loan style pressure. The company and its infrastructure have been hit before: in April 2023, Allbridge was exploited on the BNB Chain via a flash loan against a pool there, according to a technical analysis published by SolidityScan.

That earlier incident reportedly involved an attacker acting as both liquidity provider and swapper while exploiting business logic in a smart contract. The mechanism allowed the attacker to manipulate swap prices, which led to reported drains of $289,900 in BUSD and $290,900 in USDt.

While each bridge deployment and asset routing can differ, the continuity in tactics—flash loans combined with liquidity pool price manipulation—signals a broader vulnerability class. In many cross-chain designs, bridges rely on liquidity pools to support issuance and redemption of bridged assets. If pool accounting and swap logic can be influenced within a single transaction sequence, attackers may generate profit without needing long-term capital exposure.

The near-term uncertainty for users is how thoroughly Allbridge Core investigated the precise smart contract paths involved on Solana and whether any additional pools—or liquidity routes—were affected beyond the reported $1.65 million figure.

Cross-chain bridges targeted since May

This Allbridge Core incident lands in the middle of a broader streak of reported bridge attacks. Earlier coverage from Cointelegraph detailed how multiple protocols urged user withdrawals or paused bridge services following exploits, reflecting how quickly damage can spread when attackers identify liquidity weaknesses.

In June, Cointelegraph reported that Taiko, an Ethereum layer-2 network, urged users to withdraw assets after attackers exploited one of its bridge protocols and stole $1.7 million. Taiko later reopened its bridge 11 days later after completing a four-step recovery plan.

Weeks before that, Cointelegraph reported that Secret Network was exploited via an “infinite mint” bug in a vulnerable smart contract. That incident reportedly resulted in $4.67 million in unbacked Axelar-wrapped assets.

Other bridge failures mentioned in recent reporting include Cointelegraph’s reports on the Gravity Bridge halting after a reported $54 million exploit, the Verus Bridge reportedly being exploited for millions, and Butter Network losing most of its value after a reported quadrillion token mint exploit.

Taken together, the pattern is consistent: bridge systems concentrate liquidity, and that liquidity often translates into high payoff for attackers who can manipulate pricing, mint/burn mechanics, or settlement logic across chains. When protocols respond with pauses and user-withdrawal instructions, they are effectively trying to limit further exposure while remediation work is underway.

For users, the next watchpoints are straightforward: whether Allbridge Core confirms the full scope of affected pools, when the protocol restarts (if it does), and what safeguards are described in the aftermath—especially around pool invariants and flash-loan-resistance. Until those details are clear, liquidity providers should assume that temporary pricing distortions may not fully resolve without an operational pause.