Allbridge paused its Core cross-chain bridge protocol on July 20, 2026, after an attacker drained roughly $1.65 million from its Solana deployment utilizing a flash mortgage to govern the pool’s change fee.
What Occurred to Allbridge
The hack was first flagged by Lookonchain on the social media platform X, whereby the attacker took a $1.12 million USDC flash mortgage from the lending protocol Kamino, then executed fast USDC/USDT swaps to distort the change fee inside Allbridge Core’s stablecoin pool. With the speed manipulated, the attacker withdrew liquidity on the skewed worth, repaid the unique $1.12 million mortgage, and stored the distinction.
Allbridge confirmed the incident in a submit on X, writing: “Allbridge Core is experiencing a safety incident. We’ve paused the protocol as a precaution whereas we examine. You probably have liquidity in affected swimming pools, please withdraw now.”
The corporate additionally acknowledged the exploit created a brief arbitrage window, including, “In the event you took benefit of it, please take into account returning funds… it will go instantly towards compensating affected LPs.”
This isn’t Allbridge’s first flash mortgage incident. In April 2023, an attacker exploited a wise contract flaw in Allbridge’s BNB Chain pool for $573,000, cut up between roughly $289,900 in BUSD and $290,900 in USDT.
Allbridge recovered about $465,000 of that earlier theft by way of a white-hat hacker association, although this restoration just isn’t independently corroborated by the opposite sources reviewed for this piece. Individually, Allbridge built-in with Algorand in January 2026, increasing its cross-chain stablecoin capabilities shortly earlier than this newest incident.
The Greater Image
Main unbiased digital media platform Cointelegraph had counted this as at the very least the sixth cross-chain bridge exploit since Might.
A part of this sample that features Taiko’s Ethereum layer-2 bridge, which misplaced $1.7 million in June earlier than reopening 11 days later following a four-step restoration plan, and Secret Community, which misplaced $4.67 million to an “infinite mint” bug that created unbacked variations of Axelar-wrapped belongings. Furthermore, Gravity Bridge, Verus Bridge, and the Butter Community have additionally been focused in latest months, together with Kelp DAO’s LayerZero-powered bridge, which misplaced $292 million in a single exploit in April 2026.
For broader context on how DeFi platforms handle this sort of threat, our protection of DeFi adoption progress tracks associated safety and infrastructure developments, and our crypto scams to keep away from information covers patterns price watching throughout the house typically.
What Comes Subsequent
Whether or not Allbridge can get better funds spanning two blockchain ecosystems, because it partially did after its 2023 incident, stays the important thing scenario to observe. On-chain intelligence platforms are seemingly maintaining observe of the attacker’s pockets, and any motion towards centralized change deposit addresses may sign whether or not a freeze or restoration turns into doable.
What this implies for you: when you’ve got liquidity in Allbridge Core’s affected swimming pools, Allbridge has suggested withdrawing now whereas the investigation continues. This incident seemingly takes us again to bridges that maintain pooled funds backing belongings on vacation spot chains, which stay a recurring goal for exploits throughout the business.