On July 20, Allbridge’s Core cross-chain protocol suspended operations after a flash loan exploit drained $1.65 million from its Solana stablecoin liquidity pools.

The attacker manipulated the protocol’s own pricing logic, highlighting an advanced sophistication in DeFi exploits that extends beyond mere theft into complex economic attacks.

Allbridge’s Core moves native USDC and USDT tokens across blockchains without wrapping them, relying heavily on accurate pricing within its liquidity pools. This architecture creates a critical attack surface: any distortion in pool valuation can be weaponized for financial gain.

The attack began with a $1.12 million flash loan from Kamino, a Solana lending protocol. Flash loans execute instantly within one transaction, allowing attackers to borrow vast sums with no upfront capital and manipulate pool pricing by swapping USDC and USDT repeatedly.

This manipulation skewed the internal price ratios, enabling the attacker to exchange just a few thousand dollars in USDT for roughly $2.24 million in USDC. The core vulnerability was a mispriced liquidity pool that made such an outsized conversion appear legitimate.

Immediately after, stolen funds were bridged from Solana to Ethereum and distributed across multiple addresses, complicating recovery efforts. Firms like CertiK, PeckShield, and Arkham Intelligence tracked these movements, underscoring how cross-chain bridges can facilitate fund obfuscation.

Allbridge responded by pausing the Core protocol and advising liquidity providers to withdraw funds from impacted pools. They also publicly requested arbitrageurs who profited from the distortion to return gains, an uncommon call that indicates the exploit’s disruptive ripple across DeFi trading.

This incident is not isolated: Allbridge suffered a flash loan attack in April 2023 on its BNB Chain pools, losing around $573,000. The recurring nature of such exploits suggests persistent systemic issues in bridge protocols.

The event underlines the increasing challenge DeFi platforms face in safeguarding liquidity pools against flash loan attacks that harness economic logic rather than just technical vulnerabilities. It serves as a caution for investors and protocols leveraging cross-chain liquidity, emphasizing the need for enhanced pricing oracles and real-time fraud detection.

This article is for informational purposes only and does not constitute financial advice.