Allbridge paused its Allbridge Core cross-chain stablecoin bridge on July 19, 2026 after an attacker drained roughly $1.65 million from Solana liquidity pools. Security firms PeckShield and Onchain Lens, as reported by CoinDesk and Cointelegraph, say the raid used a $1.12 million USDC flash loan from Kamino to distort pool ratios, withdraw liquidity at manipulated rates, repay the loan in the same transaction, and keep the difference.

What Allbridge said

In a Sunday post on X, the team confirmed a security incident, said it had paused the protocol as a precaution, and told liquidity providers in affected pools to withdraw now. It also said the pool imbalance briefly opened a positive arbitrage window and asked traders who took that window to return funds to a published address so the money could go toward compensating affected LPs:

0x01a494079DCB715f622340301463cE50cd69A4D0

That voluntary-return ask is unusual but practical. Once a stable pool is skewed, anyone who can see the distortion can trade against it; the original attacker is not the only party who can end up with value that came from LP inventory.

A follow-up post Monday said the incident accelerated a transition the team had already planned: in about three months, Allbridge Core and Allbridge Classic will stop operating in their current form, with traffic moving toward Allbridge Next, which the project describes as newer infrastructure. LPs were told again to withdraw ahead of that sunset.

How the drain worked

The public on-chain reconstruction is consistent across PeckShield, Onchain Lens, CoinDesk, CryptoPotato, and The Crypto Times:

  1. Borrow about $1.12 million USDC from Kamino on Solana (no collateral, repaid in the same transaction).
  2. Run rapid USDC/USDT swaps through Allbridge Core’s Solana pools to skew the stablecoin ratio.
  3. Withdraw liquidity at the distorted rate, repay the flash loan, and pocket the residual.
  4. Bridge the proceeds from Solana to Ethereum, convert toward ETH, and move some value into privacy pools to slow tracing.

The design detail that matters is simple. Allbridge Core holds native stablecoin liquidity on each chain so transfers can settle without wrapped-token wrappers. That is efficient for users and expensive when withdrawal pricing reads reserves that a single large swap just moved. Immunefi security lead Gonçalo Magalhães, quoted in The Crypto Times, framed the failure mode as pools where imbalance is cheap and exit pricing still trusts those post-swap reserves: capital alone is enough.

Second time for the same pattern

This is not Allbridge’s first flash-loan hit. In April 2023, Core lost about $573,000 on BNB Chain when an attacker acted as both liquidity provider and swapper to manipulate prices (roughly half BUSD, half USDT), according to CryptoPotato and contemporaneous coverage. Most of that haul was later returned under a white-hat arrangement.

A second pool-manipulation loss three years later is the uncomfortable part of the story. Safeguards added after 2023, including rebalancing authority meant to correct skewed pools, did not stop Sunday’s Solana drain. Recovery negotiations may still happen; history gives a template, not a guarantee, especially once funds have crossed chains and entered privacy tooling.

Why bridges keep showing up on the list

Cointelegraph counts this as at least the sixth cross-chain bridge attack since May, after incidents including Taiko ($1.7M), Secret Network / Axelar-wrapped assets ($4.67M), Gravity Bridge, Verus Bridge, and Butter Network. Bridges concentrate assets that back transfers on the far side. One bad pricing assumption empties the float that makes the product useful.

Latin American users already route dollar stablecoins across chains for remittances, freelancing, and treasury moves. A Core-style pool is not “your wallet got hacked”; it is LP inventory and bridge inventory under program rules. If you provided liquidity, the loss path is pool math. If you only used the bridge as a customer and still hold assets in your own keys, the risk is downtime and incomplete routes while Core is paused, not an automatic key compromise. Self-custody still wins for long-term balances you control; it does not rewrite the risk of parking capital inside someone else’s AMM.

What to watch

  • Whether any of the stolen ETH lands on exchange deposit addresses that can freeze inflows (on-chain trackers are watching).
  • Voluntary returns to Allbridge’s published address, and whether the team later posts a full loss and compensation accounting.
  • The Allbridge Next migration: product docs and LP withdrawal deadlines over the next three months, not marketing slides.

If you still have liquidity in affected Allbridge Core pools, treat the team’s own instruction as the operational fact: withdraw while you can. Pause notices and status posts are part of the product risk, not a footnote. Not financial advice.