Allbridge Core halted its operations after an attacker drained over $1.1 million by exploiting its stablecoin liquidity pools on Solana. This incident highlights the persistent vulnerabilities flash loan mechanisms introduce to DeFi protocols, especially those managing stablecoins like USDC and USDT.

Inside the Exploit: Mechanism and Implications

The attacker leveraged a $1.12 million USDC flash loan provided by Kamino, using a rapid sequence of swaps to manipulate the USDC/USDT pool ratios. This manipulation caused the pool to reflect distorted values, allowing liquidity withdrawals at inflated prices. Crucially, the flash loan was repaid within the same transaction, minimizing traceability and maximizing gain, with Onchain Lens estimating losses exceeding $1.1 million.

Post-exploit, stolen funds were channeled through privacy protocols, complicating tracking and recovery efforts. also the protocol recorded a significant withdrawal of $2.24 million USDC, suggesting multiple vectors or sequential transactions may have been involved.

This exploit is not isolated. In the broader context, July 2026 saw a surge in crypto protocol thefts, tallying $57.8 million in losses across various platforms. Allbridge itself faced a similar flash loan exploit in April 2023 on the BNB network, resulting in $570,000 lost. These repeated breaches shows ongoing challenges in securing liquidity pools against rapid, automated manipulation.

Following the attack, Allbridge paused its protocol and initiated an investigation. The temporary imbalance created arbitrage opportunities, which the team has urged traders to reverse by returning ill-gotten funds. They emphasized a commitment to restoring all affected liquidity provider funds to maintain trust.

The incident serves as a stark example of how flash loan exploits can disrupt stablecoin pools, posing systemic risks to DeFi ecosystems reliant on liquidity stability. Protocol developers and investors must remain vigilant, as attackers increasingly utilize sophisticated, rapid mechanisms to exploit arbitrage windows before detection or mitigation is possible.

This material is informational and does not constitute financial advice.