Audit log

Every state-changing event for Allbridge Core — CCTP Base Chain Exploit (August 2026): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-22 12:06:17Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   81Ai2fMVWwkh…d23gv1SUcopysha256 → base58

   verifying row…

   canonical bytes (18698 B) ▸

   {"actor":"system:backfill","investigation_id":"7be2e44e-2114-4940-85f3-54a8b6b1cd26","kind":"publish","page_slug":"allbridge-core-cctp-base-chain-exploit-august-2026","published_at":"2026-08-22T12:06:17.436Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Allbridge Core — CCTP Base Chain Exploit (August 2026)","sections":[{"content":"On August 19, 2026 at approximately 01:47 UTC, an attacker identified by address 0x2419432344b0b892e592b2601b98eae702ba360e exploited Allbridge Core's newly deployed CCTP router on Base, draining the router's entire reserve of 191,156 USDC. According to analysis by Defimon, the vulnerability resided in the protocol's CCTPTokenMessenger.receiveCctpMessage function, which accepted Circle's attestation as proof of value transfer without verifying that USDC had actually been minted. The attacker crafted a fake CCTP deposit message on Polygon (reportedly prepared as early as July 25, 2026) claiming 1,000,000 USDC using Circle's generic sendMessage function, which attests arbitrary payloads with no burn-and-mint operation attached. The forged message copied a legitimate messageSender field from on-chain storage and directed the recipient to the attacker's own contract rather than Circle's TokenMessenger, meaning no USDC mint ever occurred. Because Allbridge's router required only that a nonzero credit existed — a single require(receivedAmount > 0) check — it treated message attestation as equivalent to actual token arrival. To cover the gap between the phantom $1 million deposit and the router's actual 191,156 USDC balance, the attacker obtained an 808,844 USDC flash loan from Aave, redeemed 999,000 USDC from the router (less a 10 basis point fee), repaid the loan plus a 404 USDC premium, and netted approximately 189,752 USDC in profit. A legitimate CCTP transfer had deposited 191,112 USDC into the router at block 50157342 at 01:47:11 UTC; the exploit executed three blocks later, claiming those funds before the bridge's own relayer could forward them to their intended recipient.","heading":"August 2026 CCTP Base Chain Exploit","severity":"critical","sources":[{"credibility":2,"name":"Allbridge $191K Phantom CCTP Deposit Exploit (Aug 19) — Defimon","type":"research","url":"https://defimon.xyz/blog/allbridge-hack-august-2026"}]},{"content":"According to Defimon's analysis, a copycat attacker reproduced the exploit within 25 minutes of the original attack using ordinary retail tools, demonstrating that the vulnerability was not sophisticated and required no specialized access. The root flaw — conflating message authenticity with value settlement — is not unique to Allbridge. Any cross-chain protocol that accepts CCTP attestations without independently verifying that a corresponding USDC mint occurred on the destination chain is potentially exposed to the same attack pattern. Defimon's report notes that Allbridge's immediate containment response — deregistering CCTP messengers on Arbitrum, Base, and Polygon — stopped further losses but did not patch the underlying contract logic, meaning any redeployment with a registered messenger would reopen the vulnerability unless the receiveCctpMessage function is rewritten to verify balance changes. The broader implication is that Circle's sendMessage function can be used to obtain a valid attestation for an arbitrary payload that does not correspond to a real burn-and-mint event, and that protocols must not rely solely on attestation validity as a proxy for token settlement.","heading":"Attack Replication and Systemic Risk","severity":"critical","sources":[{"credibility":2,"name":"Allbridge $191K Phantom CCTP Deposit Exploit (Aug 19) — Defimon","type":"research","url":"https://defimon.xyz/blog/allbridge-hack-august-2026"},{"credibility":2,"name":"Circle's CCTP Noble Mint Bug — Asymmetric Research","type":"research","url":"https://blog.asymmetric.re/circles-cctp-noble-mint-bug/"}]},{"content":"Following detection of the August 19 exploit, Allbridge deregistered CCTP messengers on Arbitrum at 05:15:52 UTC, Base at 05:22:51 UTC, and Polygon at 05:28 UTC. The team also revoked USDC allowances. According to Defimon's reporting, Allbridge did not modify the vulnerable contract logic and the underlying vulnerability remained unfixed as of the time of reporting. Allbridge had previously paused cross-chain operations in July 2026 following the Solana flash loan exploit, and LP positions across the protocol remained at risk during successive investigation periods. The protocol's post-July pivot toward CCTP routing — intended as a security improvement over liquidity pool architecture — thus produced a new and distinct attack surface less than one month after being deployed.","heading":"Protocol Response","severity":"high","sources":[{"credibility":2,"name":"Allbridge $191K Phantom CCTP Deposit Exploit (Aug 19) — Defimon","type":"research","url":"https://defimon.xyz/blog/allbridge-hack-august-2026"},{"credibility":2,"name":"Allbridge Core pauses protocol after $1.65 million flash loan exploit — The Block","type":"news_article","url":"https://www.theblock.co/post/408855/allbridge-core-exploit"}]},{"content":"On July 19, 2026 at approximately 17:51 UTC, Allbridge Core suffered a $1.65 million exploit on its Solana deployment. The attacker borrowed $1.12 million USDC from the Solana lending protocol Kamino without collateral, then executed a series of same-asset swaps within Allbridge Core's USDC/USDT stablecoin pool — passing the same Pool account in both the send and receive roles of the swap instruction. Because the contract did not enforce that the two roles must reference distinct accounts, internal accounting updates from one role were silently overwritten by the other while actual token transfers had already settled. Five self-swaps distorted the pool's recorded state sufficiently for the attacker to convert a small USDT input into approximately $2.24 million USDC before bridging funds from Solana to Ethereum. Net losses were approximately $1.65 million after the flash loan was repaid. The stolen funds were subsequently moved into privacy pools. Allbridge paused the protocol approximately 30 minutes after the exploit was detected and urged liquidity providers to withdraw. The team stated that the new version of Core would remove liquidity pools entirely and shift to routing via CCTP and LayerZero — a pivot that was followed by the August 19 CCTP exploit. Multiple outlets including CoinDesk, Decrypt, and Cointelegraph confirmed these details.","heading":"July 2026 Solana Flash Loan Exploit","severity":"critical","sources":[{"credibility":1,"name":"Cross-chain protocol Allbridge halts after $1.65 million flash loan exploit — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/07/20/cross-chain-protocol-allbridge-halts-after-usd1-65-million-flash-loan-exploit"},{"credibility":2,"name":"Allbridge Pauses Cross-Chain Protocol After $1.65M Flash Loan Attack — Decrypt","type":"news_article","url":"https://decrypt.co/373831/allbridge-pauses-cross-chain-protocol-after-1-65m-flash-loan-attack"},{"credibility":2,"name":"Allbridge Core Pauses Cross-Chain Bridge after $1.65M Exploit — Cointelegraph","type":"news_article","url":"https://cointelegraph.com/news/allbridge-core-pauses-cross-chain-bridge-after-165m-exploit"},{"credibility":2,"name":"Allbridge Core pauses protocol after $1.65 million flash loan exploit — The Block","type":"news_article","url":"https://www.theblock.co/post/408855/allbridge-core-exploit"},{"credibility":2,"name":"Allbridge Flash-Loan Exploit: How Pool Manipulation Drained $1.65 Million — CryptoDaily","type":"news_article","url":"https://cryptodaily.co.uk/2026/07/allbridge-flash-loan-exploit-pool-manipulation"}]},{"content":"On April 1–2, 2023, Allbridge Core suffered an earlier flash loan exploit on BNB Chain in which attackers drained approximately $570,000 to $650,000 from USDT and BUSD liquidity pools. The attack exploited a logic flaw in the withdraw function that allowed manipulation of the swap price by acting simultaneously as both liquidity provider and swapper. The attacker drained approximately $289,900 in BUSD and $290,900 in USDT. Following that incident, Allbridge worked with a white-hat researcher to recover approximately $465,000 and committed to deploying a single liquidity pool per chain — an architectural change intended to prevent same-transaction flash loan manipulation. The July 2026 Solana exploit demonstrated that this architectural fix was not applied to Solana deployments, which retained the dual-pool structure needed for the same style of manipulation.","heading":"April 2023 BNB Chain Flash Loan Exploit","severity":"high","sources":[{"credibility":2,"name":"Decoding AllBridge $570K Flash Loan Exploit — QuillAudits / Coinmonks","type":"research","url":"https://medium.com/coinmonks/decoding-allbridge-570k-flash-loan-exploit-quillaudits-8da8dccd729d"},{"credibility":2,"name":"Allbridge Core Loses $1.65M to Flash Loan Again After Its Single-Pool Fix Missed Solana — TechTimes","type":"news_article","url":"https://www.techtimes.com/articles/321044/20260720/allbridge-core-loses-165m-flash-loan-again-after-its-single-pool-fix-missed-solana.htm"}]},{"content":"Allbridge Core has suffered three distinct material security incidents across 2023 and 2026, each exploiting a different layer of the protocol's architecture. The 2023 BNB Chain exploit targeted pool swap pricing logic. The July 2026 Solana exploit targeted same-asset swap input validation. The August 2026 Base exploit targeted CCTP attestation verification. Each remediation introduced a new exposure: the single-pool fix after 2023 was not applied uniformly, and the CCTP pivot taken after July 2026 introduced the attestation-verification flaw exploited in August. Security researchers have noted the irony that the Base CCTP router was deployed explicitly as a security improvement over the pool architecture it replaced. The protocol's three-incident track record within a 39-month window, with each exploit involving a different root cause, suggests systemic deficiencies in security review processes and cross-chain integration testing rather than any single point of failure.","heading":"Pattern of Repeated Exploit Vectors","severity":"high","sources":[{"credibility":2,"name":"Allbridge $191K Phantom CCTP Deposit Exploit (Aug 19) — Defimon","type":"research","url":"https://defimon.xyz/blog/allbridge-hack-august-2026"},{"credibility":2,"name":"Allbridge Flash Loan Attack Drains $1.65M — For the Second Time — Cryptonomist","type":"news_article","url":"https://en.cryptonomist.ch/2026/07/20/allbridge-flash-loan-attack/"},{"credibility":2,"name":"~$39.5M Lost: Allbridge, Wanchain and More — BlockSec Weekly","type":"research","url":"https://blocksec.com/blog/web3-security-allbridge-wanchain-exploits"}]},{"content":"Allbridge Core is a cross-chain stablecoin bridge that facilitates the transfer of USDC, USDT, and other stablecoins across multiple blockchains including Ethereum, Solana, Base, Arbitrum, Polygon, and BNB Chain, among others. The protocol supports both pool-based transfers and routing through Circle's Cross-Chain Transfer Protocol (CCTP). Allbridge integrates CCTP as an official integration partner of Circle, enabling zero-slippage USDC transfers on supported routes. L2BEAT classifies Allbridge as a bridge with on-chain contract activity verified across multiple chains. As of the time of the August 2026 exploit, the protocol had CCTP Bridge contracts deployed on Base (0x1efe2c85989d97febbd0743cdd79b9f0826314f6), Ethereum, and Arbitrum, among others.","heading":"Protocol Background","severity":"medium","sources":[{"credibility":2,"name":"Allbridge — L2BEAT","type":"other","url":"https://l2beat.com/bridges/projects/allbridge"},{"credibility":1,"name":"Allbridge: CCTP Bridge on Base — BaseScan","type":"on_chain","url":"https://basescan.org/address/0x1efe2c85989d97febbd0743cdd79b9f0826314f6"},{"credibility":2,"name":"What is Allbridge Core? — Official Docs","type":"official","url":"https://docs-core.allbridge.io/"}]}],"sources_used":[{"credibility":2,"name":"Allbridge $191K Phantom CCTP Deposit Exploit (Aug 19) — Defimon","type":"research","url":"https://defimon.xyz/blog/allbridge-hack-august-2026"},{"credibility":2,"name":"Top 10 Biggest DeFi Hacks of 2026 (So Far) — Defimon","type":"research","url":"https://defimon.xyz/blog/top-10-defi-hacks-2026"},{"credibility":1,"name":"Cross-chain protocol Allbridge halts after $1.65 million flash loan exploit — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/07/20/cross-chain-protocol-allbridge-halts-after-usd1-65-million-flash-loan-exploit"},{"credibility":2,"name":"Allbridge Pauses Cross-Chain Protocol After $1.65M Flash Loan Attack — Decrypt","type":"news_article","url":"https://decrypt.co/373831/allbridge-pauses-cross-chain-protocol-after-1-65m-flash-loan-attack"},{"credibility":2,"name":"Allbridge Core Pauses Cross-Chain Bridge after $1.65M Exploit — Cointelegraph","type":"news_article","url":"https://cointelegraph.com/news/allbridge-core-pauses-cross-chain-bridge-after-165m-exploit"},{"credibility":2,"name":"Allbridge Core pauses protocol after $1.65 million flash loan exploit — The Block","type":"news_article","url":"https://www.theblock.co/post/408855/allbridge-core-exploit"},{"credibility":2,"name":"Allbridge Core Pauses After $1.65M Flash-Loan Exploit — CryptoDaily","type":"news_article","url":"https://cryptodaily.co.uk/2026/07/allbridge-core-pauses-flash-loan-exploit"},{"credibility":2,"name":"Allbridge Flash-Loan Exploit: How Pool Manipulation Drained $1.65 Million — CryptoDaily","type":"news_article","url":"https://cryptodaily.co.uk/2026/07/allbridge-flash-loan-exploit-pool-manipulation"},{"credibility":2,"name":"Allbridge Core Loses $1.65M to Flash Loan Again After Its Single-Pool Fix Missed Solana — TechTimes","type":"news_article","url":"https://www.techtimes.com/articles/321044/20260720/allbridge-core-loses-165m-flash-loan-again-after-its-single-pool-fix-missed-solana.htm"},{"credibility":2,"name":"Allbridge Halts Core Bridge After $1.65M Flash Loan Exploit — The Defiant","type":"news_article","url":"https://thedefiant.io/news/hacks/allbridge-halts-core-bridge-after-1-65m-flash-loan-exploit"},{"credibility":2,"name":"Allbridge exploited for $2M, funds bridged from Solana to Ethereum — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/allbridge-exploit-solana-ethereum-bridge/"},{"credibility":2,"name":"Decoding AllBridge $570K Flash Loan Exploit — QuillAudits / Coinmonks","type":"research","url":"https://medium.com/coinmonks/decoding-allbridge-570k-flash-loan-exploit-quillaudits-8da8dccd729d"},{"credibility":2,"name":"~$39.5M Lost: Allbridge, Wanchain and More — BlockSec Weekly","type":"research","url":"https://blocksec.com/blog/web3-security-allbridge-wanchain-exploits"},{"credibility":2,"name":"Allbridge — L2BEAT","type":"other","url":"https://l2beat.com/bridges/projects/allbridge"},{"credibility":1,"name":"Allbridge: CCTP Bridge on Base — BaseScan","type":"on_chain","url":"https://basescan.org/address/0x1efe2c85989d97febbd0743cdd79b9f0826314f6"},{"credibility":2,"name":"Circle's CCTP Noble Mint Bug — Asymmetric Research","type":"research","url":"https://blog.asymmetric.re/circles-cctp-noble-mint-bug/"},{"credibility":2,"name":"Allbridge Core Updates Following the Relaunch — Allbridge Medium","type":"official","url":"https://allbridge.medium.com/allbridge-core-updates-following-the-relaunch-9f7716eeb5da"},{"credibility":2,"name":"What is Allbridge Core? — Official Docs","type":"official","url":"https://docs-core.allbridge.io/"}],"summary":"Allbridge Core, a cross-chain stablecoin bridge, suffered its third material security incident in 2026 on August 19 when an attacker exploited a missing balance verification in the protocol's newly deployed CCTP router on Base, draining 191,156 USDC. The attack, which involved crafting a forged Circle CCTP attestation message to book a phantom $1 million deposit before using a flash loan to cover the funding gap, represents a novel attack class with potential systemic implications for other protocols that accept CCTP attestations without verifying corresponding balance changes. This followed a $1.65 million flash loan exploit on Solana in July 2026 and an earlier BNB Chain exploit in April 2023.","timeline":[{"date":"2023-04-02","event":"Allbridge Core exploited on BNB Chain for approximately $570,000–$650,000 via flash loan pool price manipulation. Approximately $465,000 subsequently recovered through white-hat arrangement.","source":"QuillAudits / Coinmonks","source_url":"https://medium.com/coinmonks/decoding-allbridge-570k-flash-loan-exploit-quillaudits-8da8dccd729d"},{"date":"2026-07-19","event":"Allbridge Core exploited on Solana for approximately $1.65 million via same-asset swap input validation flaw, exploiting the same flash loan pool manipulation class as the 2023 attack on a deployment where the single-pool fix was not applied. Stolen funds bridged to Ethereum.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2026/07/20/cross-chain-protocol-allbridge-halts-after-usd1-65-million-flash-loan-exploit"},{"date":"2026-07-19","event":"Allbridge pauses cross-chain protocol approximately 30 minutes after the Solana exploit is detected. Team urges liquidity providers to withdraw and announces investigation.","source":"The Block","source_url":"https://www.theblock.co/post/408855/allbridge-core-exploit"},{"date":"2026-07-20","event":"Allbridge announces new version of Core will remove liquidity pools and shift routing to Circle CCTP and LayerZero to prevent pool imbalance attacks.","source":"Decrypt","source_url":"https://decrypt.co/373831/allbridge-pauses-cross-chain-protocol-after-1-65m-flash-loan-attack"},{"date":"2026-08-19","event":"Allbridge Core's new CCTP router on Base exploited at 01:47 UTC. Attacker forges a Circle CCTP attestation message to book a phantom $1,000,000 deposit, flash-loans 808,844 USDC from Aave to cover the funding gap, and drains the router's entire 191,156 USDC reserve. Net attacker profit approximately 189,752 USDC. A copycat attacker reproduces the exploit within 25 minutes.","source":"Defimon","source_url":"https://defimon.xyz/blog/allbridge-hack-august-2026"},{"date":"2026-08-19","event":"Allbridge deregisters CCTP messengers on Arbitrum (05:15 UTC), Base (05:22 UTC), and Polygon (05:28 UTC) and revokes USDC allowances. Underlying contract logic not patched.","source":"Defimon","source_url":"https://defimon.xyz/blog/allbridge-hack-august-2026"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 0bd07dcb-bf50-4cf1-8e0e-f96a2b7fc922copy