Allbridge Core Second Flash-Loan Exploit (July 2026)
Summary
On July 19–20, 2026, Allbridge Core, a cross-chain stablecoin bridge protocol, suffered a $1.65–1.66 million flash-loan exploit targeting its Solana USDC/USDT liquidity pools — the second structurally similar attack on the protocol since April 2023. An attacker borrowed $1.12 million USDC from Kamino Finance, manipulated the pool's internal stablecoin ratio through rapid swaps, extracted liquidity at distorted rates, then bridged the proceeds to Ethereum before the protocol was paused. The incident raised serious questions about the completeness of post-2023 remediation, specifically the failure to apply the protocol's own 'single-pool per blockchain' fix to its Solana deployment.
Connected Entities
2 entities · 10 linked investigations- FhffBraZsGn4H2LxLNToEcaHWEfWwT2UcSz4oRHb7Qdc→mentioned with→Allbridge Core Second Flash-Loan Exploit (July 2026)(50%)
Connected Through
1 shared actor · 1 investigationDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- ◇FhffBr…7Qdcwallet
Timeline(8 events)
2023-04-01
Allbridge Core suffers its first flash-loan exploit on BNB Chain, draining approximately $573,000 in BUSD and USDT. Attacker acted as both liquidity provider and swapper to manipulate pool pricing.
Decoding AllBridge $570K Flash Loan Exploit — QuillAudits / Coinmonks2023-05-01
Allbridge publishes post-exploit postmortem committing to single-pool-per-blockchain architecture to prevent flash loan attacks, introduces Rebalancer Authority, and opens contracts on GitHub. Recovers approximately $465,000 via white-hat offer.
Allbridge Core Updates Following the Relaunch — Allbridge Medium2024-07-17
Halborn completes security assessment of Allbridge Bridge and ERC20 contracts (engagement ran June 17 – July 17, 2024).
Bridge Contracts Audit — Halborn2026-07-19
At approximately 17:51 UTC, an attacker initiates a $1.12 million USDC flash loan from Kamino Finance on Solana and executes a nine-step pool manipulation against Allbridge Core's USDC/USDT stablecoin pool, draining approximately $1.65–1.66 million.
Allbridge Core Pauses Bridge After $1.66M Solana Flash Loan Exploit — NFTEvening2026-07-19
Allbridge Core protocol is paused within approximately 25 minutes of the exploit. Stolen funds are bridged from Solana wallet FhffBraZsGn4H2LxLNToEcaHWEfWwT2UcSz4oRHb7Qdc to Ethereum address 0x651591b68A9c9650FB23F642162353306281ffDe, converted to ETH, and routed through Railgun, NEAR Intents, and Zcash Orchard.
Crypto Patel on X — attacker wallet addresses2026-07-20
Allbridge issues public statement confirming the security incident, urging LP withdrawals, appealing to arbitrageurs to voluntarily return profits, and announcing that Core and Allbridge Classic will cease pool-based operations within three months in favor of CCTP and LayerZero routing.
Cross-chain protocol Allbridge halts after $1.65 million flash loan exploit — CoinDesk2026-07-20
Allbridge reports tracing approximately $1.63 million of the stolen funds. No recovery of assets is confirmed. TVL of Allbridge Core falls from approximately $21.61 million to $12.78 million.
Allbridge Core Hit by $1.65M Solana Exploit, Funds Traced to Ethereum — CoinpediaDecision Log
- #1publish⛓ pending8/2/2026, 11:28:25 PMhash: 14cReAhtudv14HvVZwqCwNcidaeSHPKvTvGs6tP33uba
22 of 27 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/2/2026, 11:28:14 PM
last updated: 8/3/2026, 3:56:01 PM
avoid.net — verified advice for a post-truth world