Allbridge Halts Operations After $1.65 Million Flash Loan Exploit

Cross-chain protocol Allbridge has put operations on hold after an attacker exploited its Solana liquidity pools, resulting in a loss of approximately $1.65 million. The attacker accessed a $1.12 million flash loan from Kamino, a lending protocol on Solana, to alter the internal ratios of liquidity pools. This maneuver enabled the attacker to withdraw funds at favorable rates before bridging them to another blockchain.

In response to the incident, Allbridge paused its Core product, which facilitates the transfer of native stablecoins such as USDC and USDT between blockchains without requiring wrapped versions. The company also urged liquidity providers to withdraw their assets from the affected pools and requested that traders who profited from the price distortions return the funds.

"We are conducting a thorough investigation and will keep our community updated," stated an Allbridge spokesperson. As part of its actions, the firm highlighted the need to address the temporary imbalance created in the pools due to the exploit.

This event marks a concerning trend for Allbridge, which previously experienced a similar flash loan attack in 2023 that drained around $650,000 from its BNB Chain pools. Following that incident, Allbridge managed to recover a majority of the lost funds and made adjustments to its liquidity and withdrawal calculations.

As the investigation unfolds, questions remain regarding the extent of the stolen assets and any remaining amounts still under the attacker's control. Additionally, Allbridge's prior efforts to bolster security through a $2 million funding round in 2022 are now under scrutiny.

This situation reflects broader vulnerabilities within DeFi ecosystems, particularly around flash loans, which allow users to borrow assets briefly, often for arbitrage opportunities. The ongoing scrutiny of DeFi platforms may impact user trust and attract regulatory interest in securing these protocols against future attacks.