Allbridge Pauses Protocol After $1.65M Exploit Drains Stablecoin Liquidity Pools

Cross-chain stablecoin bridge, Allbridge Core, suffered a security exploit that resulted in losses of approximately $1.65 million, according to blockchain security firm PeckShield.

The firm said the attacker has already bridged the stolen funds from Solana to Ethereum.

Allbridge Responds

Allbridge confirmed experiencing a security incident and that the protocol has been paused as a precaution while the team investigates. The project also urged users with liquidity in affected pools to withdraw their funds immediately.

According to Allbridge, the exploit created a temporary positive arbitrage opportunity due to an imbalance in the affected liquidity pools. The team asked anyone who profited from the arbitrage to voluntarily return the funds, while adding that they would be used to compensate affected liquidity providers.

Meanwhile, blockchain security firm Onchain Labs explained that the exploit began with a $1.12 million USDC flash loan obtained from Kamino on Solana. The attacker allegedly used rapid USDC and USDT swaps to manipulate Allbridge Core’s stablecoin pool ratios before withdrawing liquidity at distorted rates, repaying the flash loan within the same transaction, and extracting the funds. Onchain Labs added that the stolen assets were later moved through privacy protocols for mixing.

Allbridge has faced a similar attack before. In April 2023, the protocol lost around $573,000 in a flash loan exploit on BNB Chain. The attacker took advantage of a bug in the smart contract to manipulate token swap prices, which allowed them to steal about $289,900 in BUSD and $290,900 in USDT.

A String of Bridge Exploits

Cross-chain bridges remain a favorite target for hackers. In April, Syndicate Labs lost about $330,000 worth of SYND tokens after a leaked private key let an attacker take control of its Commons bridge contracts.

A month later, the Verus-Ethereum bridge was exploited for more than $11 million because one of its contracts failed to validate transactions properly, although most of the funds were later returned.

In June, the Ethereum Layer 2 network Taiko told users to pull their assets from its bridges after attackers stole $1.7 million from one of its bridge protocols.