Allbridge Got Hit With the Same Exploit Twice
Allbridge Core paused after a $1.65M flash loan attack manipulated its Solana stablecoin pools — the same exploit vector that hit it in 2023.
🤖 AI TL;DR SUMMARY
- Allbridge Core paused on July 19, 2026 after a $1.65M exploit on its Solana pools.
- Attacker used a $1.12M USDC flash loan from Kamino to manipulate the pool ratio.
- Roughly $950,000 in USDT was extracted through repeated distorted-price swaps.
- Stolen funds were bridged from Solana to Ethereum and routed through privacy pools.
- TVL dropped from ~$21.6M to ~$12.8M following the exploit.
- This is the second flash loan attack on Allbridge Core; a similar $573K exploit hit BNB Chain pools in 2023.
$1.65 million gone in one transaction. And the worst part? This is the exact same attack vector Allbridge got hit with back in 2023.
I'm calling this Allbridge exploit 2026 story out because it's a masterclass in why "we fixed it" claims in DeFi need receipts, not vibes.
July 19, 2026: Allbridge Core paused after an attacker drained $1.65M from its Solana stablecoin pools. PeckShield and CertiK flagged it fast.
Here's exactly how the Allbridge Core hack worked, step by step, because the mechanics matter more than the headline number:
The attacker borrowed $1.12M in USDC via a flash loan from Kamino on Solana. Then they rapid-fired USDC-to-USDT swaps inside Allbridge's pool, deliberately breaking the pool's price ratio away from its 1:1 peg. With the ratio distorted, they redeemed liquidity at a favorable rate, repaid the flash loan in the same atomic transaction, and pocketed the spread about $950,000 net in USDT, adding up with fees to the $1.65M total damage figure.
No private keys stolen. No smart contract "hack" in the traditional sense. Just math abuse against thin liquidity — a flash loan attack Solana style that's been documented in DeFi for years.
Stolen funds got bridged from Solana to Ethereum, with part of it routed through privacy pools to make tracing harder. Classic post-exploit laundering playbook.htx+2
Allbridge's response: pause the protocol, ask LPs to withdraw, and publicly call on any arbitrageurs who profited off the price distortion to voluntarily return funds. TVL cratered from about $21.6M to $12.8M as panic withdrawals hit.
Here's my actual takeaway on this Allbridge $1.65M exploit: bridges keep getting hit by the same AMM pricing weaknesses because "fixing" a flash loan vulnerability usually means adding circuit breakers or time-weighted oracles — and that's expensive, slow, and unsexy compared to shipping new features. I've seen this trade-off kill security budgets at real teams.
If you're providing liquidity to any cross-chain bridge right now, ask yourself: does this protocol have price-manipulation circuit breakers, or am I just trusting the brand name?
Drop your take: is this an Allbridge problem, or is every thin-liquidity AMM bridge sitting on the same landmine?
❓ Frequently Asked Questions
Q:How much was stolen in the Allbridge exploit?
Approximately $1.65 million was drained from Allbridge Core's Solana stablecoin pools.
Q:How did the attacker execute the flash loan attack?
They borrowed $1.12M in USDC from Kamino, then manipulated the USDC/USDT pool ratio through rapid swaps
Q:Were private keys or smart contracts hacked?
No, the exploit relied purely on price manipulation using flash loans, not a key or contract breach
Q:What did Allbridge do in response?
Allbridge paused Core, urged LPs to withdraw, and asked profiting arbitrageurs to voluntarily return funds.
Q: Where did the stolen funds go?
Funds were bridged from Solana to Ethereum, with some routed through privacy pools.
Q:How much did Allbridge's TVL drop after the exploit?
TVL fell from roughly $21.6 million to $12.8 million.
Q:Has Allbridge been exploited before?
Yes, a similar flash loan attack hit its BNB Chain pools in April 2023 for about $573,000.
Q:What platform provided the flash loan used in the attack?
Kamino, a Solana-based lending protocol.
Q: Is Allbridge Core still paused?
As of the incident, the protocol remained paused while the team investigated.
Why Trust YourWeb3Guy
Our team of researchers and analysts deliver data-driven insights backed by on-chain analysis, market data, and years of crypto-native experience. Every article is independently reviewed for accuracy before publication.
Follow YourWeb3Guy
Never Miss Alpha
Get custom research directly to your inbox weekly.
Related Articles
Coldcard Bitcoin Attack Losses Near $89M
Hardware wallets don't save you when flawed entropy turns supposedly random Bitcoin keys into predictable targets.
Kalshi, Polymarket Volume Tops $50B in July
Kalshi and Polymarket recorded more than $50 billion in combined trading volume in July, marking a new monthly record for prediction markets.
Russia Moves to Ban Crypto Mining Until 2032
Russia is moving toward a year-round crypto mining ban across Moscow, the Moscow Region and parts of Kursk through December 2032, citing grid capacity risks.
MicroStrategy Resumes Bitcoin Buys After 5 Weeks
MicroStrategy has resumed Bitcoin purchases after a five-week pause, adding 4,048 BTC and taking its holdings to 843,773 BTC.
%3F_a%3DBAMAAAcg0&w=3840&q=75)
Vietnam Just Fined Crypto Like Drunk Driving
Vietnam's new Decree 284/2026 fines individuals up to $1,900 and companies up to $77,000 for unlicensed crypto trading, effective September 1.
%3F_a%3DBAMAAAcg0&w=3840&q=75)
Trump Just Removed the Last Roadblock on Crypto's Biggest Bill
Trump agreed to an ethics provision restricting officials from profiting off crypto, clearing the last hurdle for the CLARITY Act's Senate floor vote.
Akash Kumar Jha
With over 4 years of experience, I specialize in breaking down complex Web3 and crypto concepts into clear, actionable content. From deep-dive technical explainers to project documentation, I help brands educate and engage their audience through well-researched, developer-friendly writing.