Cross-chain bridge caught in another trap! Allbridge Core was manipulated by a flash loan to skew the exchange rate, and $1.65 million was stolen

The cross-chain bridge Allbridge Core on Solana suffered a flash loan attack, stealing approximately $1.65 million. The attackers used a $1.12 million USDC flash loan in combination with rapid token swaps to manipulate the stablecoin exchange rate, then transferred the stolen funds to Ethereum. Since this year’s May, cross-chain bridges have been hit by at least 6 attacks.
(Background: Axelar cross-chain bridge hit! Secret Network infinite minting bug stole $4.67 million)
(Background update: Taiko cross-chain bridge hit—after L2 shutdown blocks, Taiko officially announced the risk is under control, with losses of about $1.7 million)

Table of contents

Toggle

• Flash loan attack path
• The “flash loan” playbook of cross-chain bridges
• Attack frequency of cross-chain bridges this year

Cross-chain stablecoin bridge protocol Allbridge Core was attacked on Sunday, with about $1.65 million stolen. The official has suspended protocol operations and asked liquidity providers to withdraw their funds.

Allbridge posted an announcement on X saying that Allbridge Core is currently facing a security incident and the protocol has been paused to conduct an investigation.

Flash loan attack path

According to on-chain analyst Onchain Lens’s tracking, the attacker borrowed $1.12 million USDC from the Kamino lending platform, then performed rapid USDC/USDT swaps in Allbridge Core’s stablecoin pool, manipulating the pool’s exchange rate.

Lookonchain shared a full step-by-step attack diagram on X. The attacker then withdrew liquidity using the manipulated exchange rate. After repaying the $1.12 million USDC loan, they took away the remaining amount of approximately $1.65 million.

On-chain data from CertiK Alert shows that the stolen funds were transferred from the Solana cross-chain bridge to Ethereum and ultimately disappeared into a privacy pool.

The “flash loan” playbook of cross-chain bridges

This is not the first time Allbridge Core has faced a flash loan attack. In April 2023, Allbridge on BNB Chain had also suffered a loss of $573k using the same method. The attackers simultaneously acted as liquidity providers and swapers, using a smart contract vulnerability to manipulate the swap price.

Cross-chain bridges become targets for attackers because they typically hold large liquidity pools to support bridged assets on the target blockchain. All the attacker needs to do is manipulate the relative price of the assets in the pool to amplify arbitrage opportunities with a small amount of capital.

Attack frequency of cross-chain bridges this year

Allbridge Core is at least the 6th cross-chain bridge targeted since May 2026. The following are recent major events:

• Taiko (June): The cross-chain bridge of the Ethereum L2 blockchain Taiko was stolen $1.7 million; 11 days later, it completed a four-step recovery plan to reopen the bridge
• Secret Network (June): Created backed-asset-less Axelar wrapped assets through a “infinite minting” bug, losing $4.67 million
• Gravity Bridge (May): Cosmos ecosystem cross-chain bridge was attacked
• Verus Bridge (May): Ethereum cross-chain bridge was attacked, stealing tens of millions of dollars
• Butter Network (May): The MAP protocol lost 96% of its value in less than a month

The attack patterns of cross-chain bridges show a commonality among stablecoin bridges: the more concentrated the liquidity in the pool, the greater the room for exchange-rate manipulation. For DeFi users who rely on cross-chain liquidity, regularly checking the status of bridges has become a basic defensive measure.