Allbridge Core Hit by $1.65M Solana Exploit, Funds Traced to Ethereum

Cross-chain bridge protocol Allbridge Core has paused operations after suffering a security exploit that drained roughly $1.65 million from its Solana-based infrastructure.

Allbridge said it paused the protocol as a precaution and urged liquidity providers in affected pools to withdraw their funds while the investigation continues. Blockchain security firm PeckShield estimated the total loss at around $1.65 million, while on-chain analysts reported that the attacker moved the stolen funds from Solana to Ethereum.

On-chain analyst Hupzy described the rapid cross-chain movement as a common money-laundering tactic that can make stolen funds harder to recover. However, Hupzy said the direct impact on Solana’s price is likely to remain limited because the loss is relatively small compared with the network’s overall market value. 

Analyst Explains the Flash Loan Attack

According to another analyst, the incident did not involve a leaked private key or a conventional bridge exploit. Instead, the attacker reportedly used a $1.12 million flash loan from Kamino.

The attacker borrowed the USDC without collateral and then repeatedly traded USDC and USDT inside Allbridge Core’s stablecoin pool. This activity distorted the pool’s internal exchange-rate calculations and created an artificial imbalance.

The attacker then withdrew liquidity at the manipulated rate. After repaying the $1.12 million flash loan within the same transaction, the attacker kept the remaining difference as profit. The analyst said the entire attack followed a simple sequence: borrow, manipulate, withdraw, repay and keep the difference.

A single withdrawal was reportedly worth around $2.24 million.

He further described the incident as a classic flash-loan price-manipulation attack, a vulnerability pattern that has affected DeFi protocols since 2020. The analyst argued that the pool effectively trusted its own manipulable balances to determine pricing, allowing borrowed capital to distort the exchange rate.

Reports also suggested that the stolen funds were being routed through privacy-focused infrastructure, potentially making recovery more difficult.

Bigger Concern Is Bridge Confidence

Overall, the exploit is unlikely to create major direct pressure on Solana’s price. Solana (SOL) traded at $76.66, gaining 1.06% over the past 24 hours, with daily trading volume reaching $1.43 billion.

However, the incident could damage confidence in liquidity connected to cross-chain bridges. 

Now it will be interesting to see whether the attack triggers withdrawals from Solana-based bridges and causes a broader decline in bridge-related total value locked (TVL).