Overview
- The exploit, carried out Sunday, used a $1.12 million USDC flash loan from Kamino to run fast USDC/USDT swaps that skewed Allbridge Core’s Solana pool ratios and let the attacker withdraw about $1.65 million.
- On-chain trackers show the stolen funds were bridged from Solana to Ethereum, swapped into ETH and dispersed across multiple addresses including privacy pools, which complicates recovery.
- Allbridge paused its Core protocol, told liquidity providers to withdraw from affected pools and asked traders who profited from the temporary mispricing to return gains for LP compensation.
- DeFi analytics recorded a sharp fall in Allbridge Core’s total value locked as users pulled funds, and investigators from firms such as PeckShield, CertiK and Onchain Lens are tracing the flow.
- The attack highlights a recurring risk for bridges that use native liquidity pools because flash loans can manipulate internal pricing, and it raises questions about pool safeguards and the feasibility of reclaiming bridged assets.