Allbridge Core exploited on Solana - losses estimated at $1.1 million to $1.65 million

Allbridge Core paused operations on Solana after a flash-loan attack drained about $1.65 million from its stablecoin liquidity pools and bridged the stolen funds to Ethereum. The attacker used a $1.12 million flash loan from Kamino to skew Allbridge’s internal pool pricing, then swapped a small amount of USDT for about $2.24 million in USDC at distorted rates before dispersing the proceeds across Ethereum addresses. Allbridge urged liquidity providers to withdraw from affected pools, said the imbalance also created a temporary arbitrage window, and asked traders who profited from it to return funds that would go toward compensating affected LPs. The team later said user liquidity faces no further risk, Allbridge Next remains operational, and it plans to relaunch Core without liquidity pools while Core and Classic cease operating in their current form within three months. The incident is the second similar exploit for Allbridge after a 2023 flash-loan attack on its BNB Chain pools, underscoring the persistent security risks facing cross-chain bridge infrastructure in DeFi.