Cross-chain protocol Allbridge was hit by a flash loan attack, losing approximately $1.65 million, and has suspended operations.

Cross-chain bridge protocol Allbridge has suspended its Core protocol following a flash loan attack, with the attacker stealing approximately $1.65 million in assets from Solana stablecoin liquidity pools. According to analysis from blockchain security firms PeckShield and CertiK, the attacker borrowed $1.12 million in flash loan funds via Solana lending protocol Kamino, then manipulated the price mechanism in Allbridge’s pools through multiple stablecoin swaps to convert assets at a discounted rate before bridging the funds to an Ethereum address. During the attack, the attacker used thousands of dollars in USDT to obtain around $2.24 million in USDC, then bridged the funds to Ethereum and further dispersed them. It remains unclear whether any of the stolen funds can still be recovered. Allbridge said its team suspended the Core protocol for security reasons and is asking affected liquidity providers to withdraw their funds immediately. The attack caused liquidity pool imbalances, allowing some traders to profit from arbitrage opportunities. Allbridge is calling on these users to return their gains, noting the funds will be used to compensate affected LPs. The team added that user funds face no further risk at present, and will release a detailed incident analysis after completing its investigation, while planning to relaunch the Core protocol with liquidity pools removed. This is Allbridge’s second similar flash loan attack. In April 2023, the protocol’s BNB Chain liquidity pool lost approximately $573,000 due to a similar vulnerability; the project later stated it had recovered most of the funds and adjusted its liquidity calculation mechanism.