Allbridge Core Loses $1.65M to a Flash Loan Pricing Bug It Fixed in 2023

On 19 July 2026, Allbridge Core — the liquidity-pool side of the Allbridge cross-chain bridge — was drained of roughly $1.65 million in a flash-loan attack against its Solana stablecoin pools. The team paused the protocol within hours and has been urging both liquidity providers and the attacker to act.

How the pricing got manipulated

The attacker opened a $1.12 million flash loan from Kamino, a Solana lending protocol, and used it to rapidly swap USDC for USDT inside Allbridge's pool. That volume pushed the pool's internal exchange rate away from the real market price. With the pool mispriced, the attacker then swapped a small amount of USDT — reportedly a few thousand dollars' worth — for roughly $2.24 million in USDC at the distorted rate, repaid the flash loan, and walked away with the difference. The stolen funds were subsequently bridged from Solana to Ethereum and routed through privacy tools, according to on-chain analysis from PeckShield and CertiK.

The same bug, a different chain

This isn't Allbridge's first run-in with this failure mode. In April 2023, a very similar flash-loan attack drained about $573,000 from Allbridge's pools on BNB Chain by exploiting how the protocol repriced assets against each other. Allbridge recovered most of that loss through a white-hat arrangement and said it reworked its liquidity and withdrawal calculations afterward. The July 2026 incident points to the same underlying class of bug — repricing logic that breaks down when an asset is effectively priced against itself — surfacing again on a pool deployment the earlier fix apparently didn't reach.

Allbridge's response

Allbridge paused the Core protocol, told liquidity providers to withdraw from affected pools, and publicly asked anyone who profited from the mispricing to return funds, saying recovered amounts would go toward compensating affected LPs. The team also announced it is sunsetting Core and Classic within three months in favor of "Allbridge Next," a rebuild that removes pooled liquidity entirely and routes transfers through Circle's CCTP and LayerZero instead.

What this means for protocol teams

• Repricing logic that references the same asset as both the priced instrument and the collateral is a distinct bug class from a stale-oracle attack — it needs its own explicit test cases, not just a generic oracle-manipulation check.
• A fix validated on one chain's contract deployment does not automatically extend to the same logic redeployed on another chain — each deployment needs its own regression coverage against the original exploit path.
• Flash loans remain the default capital source for atomic, single-transaction pricing manipulation; "how much could be borrowed and returned in one transaction against this pool" belongs in the threat model, not just in post-incident write-ups.

Allbridge's own summary put it plainly: the attacker noticed the pricing flaw would trigger even when borrowing an asset against collateral denominated in the same token — a self-referential pricing gap that a single-asset test suite is unlikely to surface.