Allbridge Core has paused its cross-chain stablecoin protocol after an attacker stole roughly $1.65 million from its Solana liquidity swimming pools, in keeping with safety corporations CertiK and PeckShield.
Allbridge is a bridge that lets customers transfer property between blockchains that don’t talk immediately. Its Core product makes use of liquidity swimming pools to switch native stablecoins equivalent to USDC and USDT with out issuing wrapped variations of the property.
The attacker used a $1.12 million flash mortgage from Solana lending protocol Kamino to quickly swap USDC and USDT, manipulating the swimming pools’ inside ratios earlier than withdrawing property at favorable charges, in keeping with Onchain Lens. A flash mortgage is a mortgage taken and repaid throughout the identical transaction.
The stolen property had been bridged to an Ethereum tackle and dispersed throughout extra addresses. It isn’t at present clear how a lot stays beneath the attacker’s management.
Allbridge mentioned it paused the protocol whereas investigating, and advised liquidity suppliers to withdraw from affected swimming pools. The preliminary manipulation left the swimming pools imbalanced and created a short lived arbitrage alternative. Allbridge requested merchants who profited from the pricing distortion to return funds for LP compensation.
Allbridge suffered an analogous flash mortgage assault in 2023 that drained roughly $650,000 from its BNB Chain swimming pools. The agency later mentioned it recovered a lot of the funds and adjusted its liquidity and withdrawal calculations. Allbridge had raised $2 million in 2022 to develop the bridge and fund safety audits.