Allbridge
Last changed 2026-10-27 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 43. Problems weighed by who is responsible: incidents the subject suffered −20, concerns that are not fraud −6, problems around the subject, caused by others −0.3; legitimacy credit long-running +10; the penalty for incidents it suffered is capped at 20; a recent unresolved incident −16.1; 1 section(s) set aside until a failed fact-check is resolved. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -6 |
| Incidents it suffered (e.g. hacks) | -20 |
| Problems around it, caused by others | -0.3 |
| Long-running | +10 |
| Recent unresolved incident | -16.1 |
| Sum | 33 |
- The penalty for incidents it suffered is capped at 20 points.
- 1 section set aside: the claims did not hold up in a fact-check, pending correction.
Score: 43/100 (kept between 0 and 100)
How scoring works →Summary
Allbridge is a cross-chain bridging protocol founded in 2021 that operates Allbridge Classic and Allbridge Core, supporting stablecoin transfers across more than 20 blockchains. The protocol has suffered three separate security incidents since its launch: a $573K flash loan exploit on BNB Chain in April 2023, a $1.65M flash loan attack on its Solana deployment in July 2026, and a $191K CCTP router exploit on Base in August 2026 involving forged Circle attestation messages. The recurrence of similar vulnerability classes across deployments — and the failure to apply 2023 remediations to all active chains — raises systemic concerns about the protocol's security review and deployment practices.
Connected Entities
8 entities · 60 linked investigations- Binance→mentioned with→Ethereum(65%)
- Allbridge→mentioned with→Base(70%)
- Allbridge→mentioned with→Ethereum(60%)
- Allbridge→mentioned with→Solana(70%)
- Allbridge Core→mentioned with→Solana(65%)
- Allbridge→mentioned with→Polygon(70%)
- Allbridge Core→mentioned with→Ethereum(60%)
- Allbridge Core→mentioned with→Polygon(60%)
- Allbridge Core→mentioned with→Allbridge(70%)
- Allbridge→mentioned with→Allbridge Core(80%)
- + 10 more
Connected Through
8 shared actors · 624 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Ethereumorganization
- □Binanceorganization
- □Solanaorganization
- □Polygonorganization
2 submissions awaiting moderator review.
Timeline(9 events)
1 July 2021
Allbridge (originally named Solbridge) launches, focused on connecting Solana to other blockchain networks.
LI.FI Knowledge Hub — Allbridge Deep Dive1 June 2022
Allbridge Core launches as a dedicated cross-chain stablecoin swap platform.
LI.FI Knowledge Hub — Allbridge Deep Dive1 April 2023
Allbridge Core's BNB Chain pools exploited for approximately $573K via flash loan price manipulation. Attacker drained ~$289,900 BUSD and ~$290,900 USDT.
BitcoinWorld — Allbridge Exploit: Hacker Returns Majority Of $573K Stolen Funds3 April 2023
Allbridge contacts attacker on-chain offering a white-hat bounty; attacker eventually returns approximately $465,000.
Blockchain.news — Allbridge Recovers $465,000 Stolen in Crypto Exploit1 May 2023
Allbridge publishes post-mortem committing to single-liquidity-pool-per-blockchain architecture and withdrawal caps to prevent flash loan attacks.
CryptoNews — Allbridge Hack Response19 July 2026
Allbridge Core's Solana deployment exploited for approximately $1.65M via flash loan attack using Kamino Finance. Same vulnerability class as 2023 BNB Chain incident; the Solana deployment was reportedly not updated with the 2023 remediation.
CoinDesk — Cross-chain protocol Allbridge halts after $1.65 million flash loan exploit26 July 2026
Attacker prepares August 2026 CCTP exploit by calling Circle's MessageTransmitterV2.sendMessage on Polygon, forging a CCTP message claiming a 1 million USDC transfer without any actual burn. Circle generates a valid attestation for the message.
SlowMist — A Cross-Chain Attack Spanning One Month19 August 2026
Attacker executes the CCTP exploit on Allbridge's Base Router, draining approximately $191,000 in USDC. Attack leverages the pre-forged Polygon attestation and an Aave flash loan. Root cause: missing sender-identity, message-origin, and mint-amount verification in the receiveCctpMessage function.
KuCoin — SlowMist Reveals Allbridge Cross-Chain Bridge Attack Details1 August 2026
SlowMist publishes detailed post-mortem of the August 2026 CCTP exploit, flagging systemic cross-chain verification failures and warning of potential for larger attacks on higher-liquidity deployments.
SlowMist on Medium — A Cross-Chain Attack Spanning One MonthDecision Log
- slot 461967229 · hash 2KjuyE9QU258EnVKwdGyqtukXaoEXuQhF97cBhNRi4kT
- slot 459460240 · hash pWBjHUCrGkkLnb1mcUJwcBHEh2yQ2npxU9mZP5tnxYm
- slot 443561703 · hash g6uJb69nGE3E952F5McDsNxa5TPS4ZwYCWTqawbMapg
- slot 443561699 · hash AbLdsmXMFTMJHmr3gT7La8MfxMviNx9U3VA6k3SKoBmt
- slot 443527105 · hash 8LNSJ88dC7vWWY89WVJ1feUYb34sd29Xr7GurxdPVoZX
This investigation is cryptographically anchored to the Solana blockchain (5 decisions). 16 of 18 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/30/2026, 5:10:24 PM
last updated: 10/27/2026, 6:09:59 AM
4 viewsavoid.net — verified advice for a post-truth world