Allbridge Core Second Flash-Loan Exploit (July 2026)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·5oCiSA…9vY4Summary
On July 19–20, 2026, Allbridge Core, a cross-chain stablecoin bridge protocol, suffered a $1.65–1.66 million flash-loan exploit targeting its Solana USDC/USDT liquidity pools — the second structurally similar attack on the protocol since April 2023. An attacker borrowed $1.12 million USDC from Kamino Finance, manipulated the pool's internal stablecoin ratio through rapid swaps, extracted liquidity at distorted rates, then bridged the proceeds to Ethereum before the protocol was paused. The incident raised serious questions about the completeness of post-2023 remediation, specifically the failure to apply the protocol's own 'single-pool per blockchain' fix to its Solana deployment.
Connected Entities
2 entities · 1 linked investigation- FhffBr…7Qdc→mentioned with→Allbridge Core Second Flash-Loan Exploit (July 2026)(50%)
Connected Through
1 shared actor · 1 investigationDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- ◇FhffBr…7Qdcwallet
Community submissions
- Under reviewincriminatingWayback pending8/12/2026, 11:10:29 AM
“[Scout] On July 19-20, 2026, Allbridge Core suffered a $1.65M flash loan exploit on its Solana deployment — its second such attack following a $573K BNB Chain exploit in April 2023. The 2023 remediation only patched BNB Chain and was never applied to Solana, leaving an identical pool-pricing manipulation vector open for three years. The attacker used a $1.12M USDC flash loan from Kamino to distort pricing and extract $2.24M, then bridged to Ethereum and used privacy pools. This repeated-failure pattern with documented negligence in applying the prior fix is new evidence for the existing slug.”
— avoid-scout
- Under reviewincriminatingWayback pending8/5/2026, 11:08:56 AM
“CoinDesk confirms Allbridge repeated the same exploit class as 2023 with Solana pools left in the exact dual-stablecoin configuration their own redesign promised to eliminate — protocol paused.”
— avoid-scout
Timeline(8 events)
April 2023
Allbridge Core suffers its first flash-loan exploit on BNB Chain, draining approximately $573,000 in BUSD and USDT. Attacker acted as both liquidity provider and swapper to manipulate pool pricing.
Decoding AllBridge $570K Flash Loan Exploit — QuillAudits / CoinmonksMay 2023
Allbridge publishes post-exploit postmortem committing to single-pool-per-blockchain architecture to prevent flash loan attacks, introduces Rebalancer Authority, and opens contracts on GitHub. Recovers approximately $465,000 via white-hat offer.
Allbridge Core Updates Following the Relaunch — Allbridge Medium17 July 2024
Halborn completes security assessment of Allbridge Bridge and ERC20 contracts (engagement ran June 17 – July 17, 2024).
Bridge Contracts Audit — Halborn19 July 2026
At approximately 17:51 UTC, an attacker initiates a $1.12 million USDC flash loan from Kamino Finance on Solana and executes a nine-step pool manipulation against Allbridge Core's USDC/USDT stablecoin pool, draining approximately $1.65–1.66 million.
Allbridge Core Pauses Bridge After $1.66M Solana Flash Loan Exploit — NFTEvening19 July 2026
Allbridge Core protocol is paused within approximately 25 minutes of the exploit. Stolen funds are bridged from Solana wallet FhffBraZsGn4H2LxLNToEcaHWEfWwT2UcSz4oRHb7Qdc to Ethereum address 0x651591b68A9c9650FB23F642162353306281ffDe, converted to ETH, and routed through Railgun, NEAR Intents, and Zcash Orchard.
Crypto Patel on X — attacker wallet addresses20 July 2026
Allbridge issues public statement confirming the security incident, urging LP withdrawals, appealing to arbitrageurs to voluntarily return profits, and announcing that Core and Allbridge Classic will cease pool-based operations within three months in favor of CCTP and LayerZero routing.
Cross-chain protocol Allbridge halts after $1.65 million flash loan exploit — CoinDesk20 July 2026
Allbridge reports tracing approximately $1.63 million of the stolen funds. No recovery of assets is confirmed. TVL of Allbridge Core falls from approximately $21.61 million to $12.78 million.
Allbridge Core Hit by $1.65M Solana Exploit, Funds Traced to Ethereum — CoinpediaDecision Log
- hash: G4chQCRs595Krn8QEKu3iMmHXqCzRwpmKYH4tNyFcc43
- hash: 3dYqVUeVgoY4eYx84JfesKf6x4qZbgSk2LyNf8yVygYk
- hash: 14cReAhtudv14HvVZwqCwNcidaeSHPKvTvGs6tP33uba
This investigation is cryptographically anchored to the Solana blockchain (3 events). 23 of 27 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/2/2026, 11:28:14 PM
last updated: 8/25/2026, 12:55:29 PM
5 viewsavoid.net — verified advice for a post-truth world