Skip to main content
AVOID.NET

Allbridge Core — CCTP Base Chain Exploit (August 2026)

avoid.net/allbridge-core-cctp-base-chain-exploit-august-2026→8/100·72% conf.
[✓ FACT-CHECKED]· reviewed once · last review 25 Aug 2026

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·kDFPCY…myDx
last updated 2026-08-25

Summary

Allbridge Core, a cross-chain stablecoin bridge, suffered its third material security incident in 2026 on August 19 when an attacker exploited a missing balance verification in the protocol's newly deployed CCTP router on Base, draining 191,156 USDC. The attack, which involved crafting a forged Circle CCTP attestation message to book a phantom $1 million deposit before using a flash loan to cover the funding gap, represents a novel attack class with potential systemic implications for other protocols that accept CCTP attestations without verifying corresponding balance changes. This followed a $1.65 million flash loan exploit on Solana in July 2026 and an earlier BNB Chain exploit in April 2023.

Connected Entities

11 entities · 60 linked investigations
Organizations
□Polygon54□Ethereum□Allbridge Core□Allbridge Core — CCTP Base Chain Exploit (August 2026)□Arbitrum□Binance□Allbridge□Solana□Base
Protocols
⌂LayerZero — DVN Single-Verifier Configuration Risk
Tokens
♦Cointelegraph
Relationships
  • Allbridge Core — CCTP Base Chain Exploit (August 2026)→mentioned with→Polygon(70%)
  • Allbridge Core — CCTP Base Chain Exploit (August 2026)→mentioned with→Base(70%)
  • Allbridge Core — CCTP Base Chain Exploit (August 2026)→mentioned with→Allbridge(70%)
  • Allbridge Core — CCTP Base Chain Exploit (August 2026)→mentioned with→Ethereum(70%)
  • Allbridge Core — CCTP Base Chain Exploit (August 2026)→mentioned with→Arbitrum(70%)
  • Allbridge Core — CCTP Base Chain Exploit (August 2026)→mentioned with→Solana(70%)
  • Allbridge Core — CCTP Base Chain Exploit (August 2026)→mentioned with→Cointelegraph(60%)
  • Binance→mentioned with→Ethereum(65%)
  • Cointelegraph→mentioned with→Ethereum(60%)
  • Allbridge→mentioned with→Base(70%)
  • + 23 more
Also appears in
June 2026 Cross-Chain Bridge Exploit ($127M, Three Protocols)·8Polygon·54StableMagnet·2Shibarium·28JUDAO·18Shibarium Bridge·32Ionic Money·14Allo Protocol·57AnubisDAO·2SushiSwap RouteProcessor Exploit·54

Connected Through

9 shared actors · 587 investigations

Distinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.

Have evidence about Allbridge Core — CCTP Base Chain Exploit (August 2026)?
0
Accepted
2
Under review
0
Rejected / revoked

2 submissions awaiting moderator review.

Timeline(6 events)

2 April 2023

Allbridge Core exploited on BNB Chain for approximately $570,000–$650,000 via flash loan pool price manipulation. Approximately $465,000 subsequently recovered through white-hat arrangement.

QuillAudits / Coinmonks

19 July 2026

Allbridge Core exploited on Solana for approximately $1.65 million via same-asset swap input validation flaw, exploiting the same flash loan pool manipulation class as the 2023 attack on a deployment where the single-pool fix was not applied. Stolen funds bridged to Ethereum.

CoinDesk

19 July 2026

Allbridge pauses cross-chain protocol approximately 30 minutes after the Solana exploit is detected. Team urges liquidity providers to withdraw and announces investigation.

The Block

20 July 2026

Allbridge announces new version of Core will remove liquidity pools and shift routing to Circle CCTP and LayerZero to prevent pool imbalance attacks.

Decrypt

19 August 2026

Allbridge Core's new CCTP router on Base exploited at 01:47 UTC. Attacker forges a Circle CCTP attestation message to book a phantom $1,000,000 deposit, flash-loans 808,844 USDC from Aave to cover the funding gap, and drains the router's entire 191,156 USDC reserve. Net attacker profit approximately 189,752 USDC. A copycat attacker reproduces the exploit within 25 minutes.

Defimon

19 August 2026

Allbridge deregisters CCTP messengers on Arbitrum (05:15 UTC), Base (05:22 UTC), and Polygon (05:28 UTC) and revokes USDC allowances. Underlying contract logic not patched.

Defimon
Provenance & Audit Trail
Anchored on SolanaVerify on-chain18 Wayback Archives

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (4 events). 18 of 18 cited source URLs have an Internet Archive snapshot.

Fact-checked 2026-09-0734 claims checked1 correction pending0 applied⛓ anchoredSee findings →
full audit log →version history →

model: claude-sonnet-4-6

generated: 8/22/2026, 12:06:09 PM

last updated: 8/25/2026, 3:21:17 AM

3 views

avoid.net — verified advice for a post-truth world