Allbridge Core — CCTP Base Chain Exploit (August 2026)
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·kDFPCY…myDxSummary
Allbridge Core, a cross-chain stablecoin bridge, suffered its third material security incident in 2026 on August 19 when an attacker exploited a missing balance verification in the protocol's newly deployed CCTP router on Base, draining 191,156 USDC. The attack, which involved crafting a forged Circle CCTP attestation message to book a phantom $1 million deposit before using a flash loan to cover the funding gap, represents a novel attack class with potential systemic implications for other protocols that accept CCTP attestations without verifying corresponding balance changes. This followed a $1.65 million flash loan exploit on Solana in July 2026 and an earlier BNB Chain exploit in April 2023.
Connected Entities
11 entities · 60 linked investigations- Allbridge Core — CCTP Base Chain Exploit (August 2026)→mentioned with→Polygon(70%)
- Allbridge Core — CCTP Base Chain Exploit (August 2026)→mentioned with→Base(70%)
- Allbridge Core — CCTP Base Chain Exploit (August 2026)→mentioned with→Allbridge(70%)
- Allbridge Core — CCTP Base Chain Exploit (August 2026)→mentioned with→Ethereum(70%)
- Allbridge Core — CCTP Base Chain Exploit (August 2026)→mentioned with→Arbitrum(70%)
- Allbridge Core — CCTP Base Chain Exploit (August 2026)→mentioned with→Solana(70%)
- Allbridge Core — CCTP Base Chain Exploit (August 2026)→mentioned with→Cointelegraph(60%)
- Binance→mentioned with→Ethereum(65%)
- Cointelegraph→mentioned with→Ethereum(60%)
- Allbridge→mentioned with→Base(70%)
- + 23 more
Connected Through
9 shared actors · 587 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Ethereumorganization
- □Binanceorganization
- □Solanaorganization
- □Arbitrumorganization
2 submissions awaiting moderator review.
Timeline(6 events)
2 April 2023
Allbridge Core exploited on BNB Chain for approximately $570,000–$650,000 via flash loan pool price manipulation. Approximately $465,000 subsequently recovered through white-hat arrangement.
QuillAudits / Coinmonks19 July 2026
Allbridge Core exploited on Solana for approximately $1.65 million via same-asset swap input validation flaw, exploiting the same flash loan pool manipulation class as the 2023 attack on a deployment where the single-pool fix was not applied. Stolen funds bridged to Ethereum.
CoinDesk19 July 2026
Allbridge pauses cross-chain protocol approximately 30 minutes after the Solana exploit is detected. Team urges liquidity providers to withdraw and announces investigation.
The Block20 July 2026
Allbridge announces new version of Core will remove liquidity pools and shift routing to Circle CCTP and LayerZero to prevent pool imbalance attacks.
Decrypt19 August 2026
Allbridge Core's new CCTP router on Base exploited at 01:47 UTC. Attacker forges a Circle CCTP attestation message to book a phantom $1,000,000 deposit, flash-loans 808,844 USDC from Aave to cover the funding gap, and drains the router's entire 191,156 USDC reserve. Net attacker profit approximately 189,752 USDC. A copycat attacker reproduces the exploit within 25 minutes.
Defimon19 August 2026
Allbridge deregisters CCTP messengers on Arbitrum (05:15 UTC), Base (05:22 UTC), and Polygon (05:28 UTC) and revokes USDC allowances. Underlying contract logic not patched.
DefimonDecision Log
- slot 445506438 · hash GKeUKQQhtnT7WyJxw73D8sEbsrBv4ijgnkoEnMZETbDn
- slot 443511065 · hash 6XPLDTdqhBSKsSzMPZViVi7ZLCa7uo2Ab41cR2KBnL6M
- slot 443511045 · hash FSa2h5ZugcMhgYTbXmvVUZftfwF8EpbPfZ1s5Ygoi7aX
- slot 443509816 · hash 81Ai2fMVWwkht8GuMbUwLRF6mjqeKLSncR6sd23gv1SU
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 18 of 18 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/22/2026, 12:06:09 PM
last updated: 8/25/2026, 3:21:18 AM
3 viewsavoid.net — verified advice for a post-truth world