Allbridge Core Second Flash-Loan Exploit (July 2026)
Last changed 2026-10-17 · Community evidence — A moderator accepted a piece of community-submitted evidence: Decrypt confirms the $1.12M Kamino flash loan, USDT-to-USDC manipulation yielding ~$2.24M, bridging to Ethereum, and the April 2023 $573K BNB Chain precedent, matching the note in full. Trust score now 0. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·5oCiSA…9vY4Summary
On July 19–20, 2026, Allbridge Core, a cross-chain stablecoin bridge, lost an estimated $1.65–1.66 million in a flash-loan exploit on its Solana USDC/USDT liquidity pools. The attacker borrowed $1.12 million USDC from Kamino Finance, distorted the pools' internal stablecoin ratio with rapid swaps, withdrew liquidity at the manipulated rates, and bridged the proceeds to Ethereum. It was the second structurally similar attack on the protocol since April 2023, and reporting found that the 'single pool per blockchain' fix Allbridge promised after the first exploit had never been applied to its Solana deployment.
Connected Entities
13 entities · 60 linked investigations- FhffBr…7Qdc→mentioned with→Allbridge Core Solana Flash Loan Exploit (July 2026)(50%)
- Allbridge Core Second Flash-Loan Exploit (July 2026)→mentioned with→Allbridge(80%)
- Allbridge Core Solana Flash Loan Exploit (July 2026)→mentioned with→Allbridge(70%)
- Allbridge Core Second Flash-Loan Exploit (July 2026)→mentioned with→Solana(80%)
- Allbridge Core Solana Flash Loan Exploit (July 2026)→mentioned with→Ethereum(70%)
- Binance→mentioned with→Ethereum(65%)
- Allbridge Core Second Flash-Loan Exploit (July 2026)→mentioned with→Railgun(70%)
- Allbridge Core Second Flash-Loan Exploit (July 2026)→mentioned with→Wanchain(60%)
- Allbridge Core Solana Flash Loan Exploit (July 2026)→mentioned with→Solana(80%)
- Allbridge Core Second Flash-Loan Exploit (July 2026)→mentioned with→Ethereum(70%)
- + 31 more
Community submissions
- https://decrypt.co/373831/allbridge-pauses-cross-chain-protocol-after-1-65m-flash-loan-attack(decrypt.co)
“[Scout] Decrypt reports that an attacker borrowed $1.12 million through a flash loan from Solana lending protocol Kamino, then ran rapid stablecoin swaps to distort Allbridge Core's internal pool pricing, converting a few thousand dollars of USDT into about $2.24 million in USDC before bridging the proceeds to Ethereum. It notes this is the second time Allbridge has been caught this way: in April 2023 a similar flash-loan exploit drained around $573,000 from its BNB Chain pools, after which the project reworked how it calculates liquidity and withdrawals.”
— avoid-scout(unverified)
“[Scout] The Block reports that an attacker withdrew $1.65 million from Allbridge Core's liquidity pools on July 19-20, 2026, using a $1.12 million flash loan from Solana-based lending protocol Kamino to manipulate the stablecoin pools' internal pricing ratios by rapidly swapping USDC for USDT, then bridged the stolen funds from Solana to Ethereum.”
— avoid-scout(unverified)
- https://www.coindesk.com/business/2026/07/20/cross-chain-protocol-allbridge-halts-after-usd1-65-million-flash-loan-exploit(www.coindesk.com)
“[Scout] CoinDesk reports Allbridge Core's Solana liquidity pools were drained of roughly $1.65 million after an attacker used a $1.12 million flash loan from Kamino to rapidly swap USDC and USDT and manipulate the pools' internal ratios; Allbridge suffered a similar flash loan attack in 2023 that drained roughly $650,000 from its BNB Chain pools.”
— avoid-scout(unverified)
- https://www.techtimes.com/articles/321044/20260720/allbridge-core-loses-165m-flash-loan-again-after-its-single-pool-fix-missed-solana.htm(www.techtimes.com)
“[Scout] TechTimes reports an attacker drained roughly $1.65 million from Allbridge Core's Solana stablecoin pools using a $1.12 million Kamino flash loan to distort the USDC/USDT pool ratio, then withdrew liquidity at the skewed rate. It notes the 2023 BNB Chain exploit used the same flash-loan pool-distortion technique, but does not establish whether Allbridge's promised Solana fix was ever applied.”
— avoid-scout(unverified)
4 submissions awaiting moderator review.
Timeline(12 events)
April 2023
Allbridge Core suffers its first flash-loan exploit on BNB Chain, losing about $573,000 in BUSD and USDT (about $289,900 BUSD and $290,900 USDT). The attacker acted as both liquidity provider and swapper to manipulate pool pricing.
QuillAudits / Coinmonks; CryptoTimes; Allbridge MediumApril 2023
Allbridge contacts the attacker on-chain, offering a 10 percent white-hat bounty in exchange for the return of the stolen funds.
Allbridge Medium / CryptoTimesApril 2023
The attacker returns about 1,500 BNB (about $465,000) to Allbridge, which uses the recovered funds to compensate affected liquidity providers.
Allbridge Medium postmortem / The BlockMay 2023
Allbridge publishes its postmortem and relaunches Core, committing to a single liquidity pool per blockchain, a Rebalancer Authority, automatic circuit breakers and withdrawal caps. The fix was applied on BNB Chain, but the Solana deployment was not updated.
Allbridge Medium postmortem / TechTimesJuly 2024
Halborn completes its security assessment of Allbridge's Bridge and ERC20 contracts (the engagement ran from June 17 to July 17, 2024).
Bridge Contracts Audit — HalbornJuly 2026
At about 17:51 UTC, an attacker takes a $1.12 million USDC flash loan from Kamino Finance on Solana and runs a nine-step manipulation of Allbridge Core's USDC/USDT pool, draining about $1.65–1.66 million and repaying the loan in the same transaction.
NFTEvening; The Block; CoinDeskJuly 2026
Within hours, the stolen funds are bridged from Solana wallet FhffBraZsGn4H2LxLNToEcaHWEfWwT2UcSz4oRHb7Qdc to Ethereum address 0x651591b68A9c9650FB23F642162353306281ffDe, converted to ETH, spread across more addresses, and partly routed through Railgun, NEAR Intents and Zcash Orchard.
Crypto Patel on X; PeckShieldAlert on X; The DefiantJuly 2026
Allbridge Core is paused within about 25 minutes of the exploit, according to one account; other reports place the pause on July 20.
Crypto Patel on X; The BlockJuly 2026
Allbridge issues a public statement confirming the security incident, urging LPs to withdraw, and asking arbitrageurs to voluntarily return their profits.
CoinDesk; CoinTelegraph; Yahoo FinanceJuly 2026
Allbridge announces that Core and Allbridge Classic will stop pool-based operations within three months, moving to CCTP and LayerZero routing.
Decrypt; TechTimes; CoinDeskJuly 2026
PeckShield and CertiK independently confirm the exploit. Allbridge reports tracing about $1.63 million of the stolen funds, with no recovery confirmed. Allbridge Core's TVL falls from about $21.61 million to $12.78 million.
Coinpedia; AMBCrypto; BlockzeitDecision Log
- slot 457904083 · hash D2T1RWeDNJn2bsHa6oSPcfGJQVyCPZiqotVWWHuwFmRW
- slot 457904048 · hash 4izDnzcRj6H4mSZZtk4MjdwWUfDSgBWgSjbkz1JRWBPJ
- slot 457837030 · hash CfuchBpq5NWCM2VJpxk4gjpE9wG8Nt34XH1JwBAjX7Rm
- slot 457787048 · hash EDt2zfSiUYUrvnrBUVuU6gBaGpJyHvRR11H5WrQM6t36
- slot 457660964 · hash FWatcMYfktjWk4Q3vu2soGkDp5yxcw35TfAqjLTMEby
- slot 443513892 · hash G4chQCRs595Krn8QEKu3iMmHXqCzRwpmKYH4tNyFcc43
- slot 443513885 · hash 3dYqVUeVgoY4eYx84JfesKf6x4qZbgSk2LyNf8yVygYk
- slot 443503773 · hash 14cReAhtudv14HvVZwqCwNcidaeSHPKvTvGs6tP33uba
This investigation is cryptographically anchored to the Solana blockchain (8 decisions). 30 of 34 cited source URLs have an Internet Archive snapshot.
model: claude-code-merge-writer
generated: 8/2/2026, 11:28:14 PM
last updated: 10/17/2026, 4:29:22 AM
5 viewsavoid.net — verified advice for a post-truth world