Allbridge pauses bridge after $1.65M Solana exploit

Allbridge paused the Allbridge Core cross-chain bridge on Sunday after a security incident that removed $1.65 million from its Solana deployment. The attacker bridged the stolen funds to Ethereum and routed them into privacy pools.

A post on X instructed users with liquidity in affected pools to withdraw immediately and noted an ongoing investigation. The message also requested that anyone who benefited from the temporary imbalance consider returning funds to compensate liquidity providers.

Blockchain data shows the attacker executed a $1.12 million USDC flash loan, conducted rapid USDC/USDT swaps that distorted exchange rates in Allbridge Core’s stablecoin pool on Solana, then withdrew liquidity at the manipulated rate. The flash loan was repaid and the remaining proceeds were bridged to Ethereum before being moved into privacy pools.

Allbridge described the exploitation as creating a “temporary positive arbitrage window” and urged anyone who used that window to return assets so they can be used to reimburse affected liquidity providers.

The incident is at least the sixth attack on cross-chain bridges since May. Recent incidents include a $1.7 million theft from an Ethereum layer-2 bridge, a $4.67 million exploit tied to an infinite-mint bug on a wrapped-assets contract, and breaches involving additional bridge projects.

Allbridge experienced a similar flash loan attack in April 2023 that drained $573,000 from its BNB Chain pool. That earlier incident also involved manipulating swap prices inside a liquidity pool and making rapid withdrawals.

No full post‑incident report or timetable for reopening the paused protocol has been published. Investigators are tracing the flows and Allbridge is prioritizing withdrawal notices and containment measures while the probe continues.