← Allbridge Core Second Flash-Loan Exploit (July 2026)reviewed 2026-10-16 · 26 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Allbridge Core Second Flash-Loan Exploit (July 2026) against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
9 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #4[disputed][awaiting moderator]in section: Attack Mechanics
“The attacker then made repeated, alternating USDC-to-USDT swaps in the Allbridge pool, pushing the internal ratio away from parity in a nine-step manipulation sequence, and withdrew liquidity at the distorted, favorable rates.”
reviewerThe attacker's internal pool-ratio manipulation unfolded in a nine-step sequence that moved faster than the Rebalancer Authority could counterNeither of the two sources cited for this section's Attack Mechanics claims documents a nine-step sequence, and the most rigorous independent technical source found (BlockSec) gives a materially different root cause.Proposed correction (not yet applied)The attacker then made repeated, alternating USDC-to-USDT swaps in the Allbridge pool, pushing the internal ratio away from parity, and withdrew liquidity at the distorted, favorable rates; security firm BlockSec's reconstruction of the deployed program instead attributes the exploit to the swap instruction accepting the same pool account in both the send and receive roles, not a documented step-count ratio-manipulation sequence. - #5[disputed][awaiting moderator]in section: Attack Mechanics
“Post-exploit analysis identified three defense failures: dynamic fees stayed static instead of scaling with the speed of manipulation, TWAP (time-weighted average price) guards were absent, and circuit breakers did not trigger despite a ratio deviation beyond normal thresholds.”
reviewerPost-exploit analysis found dynamic fees stayed static, TWAP guards were absent, and circuit breakers failed to triggerThis presents a hedged, generic industry observation from one source as three specific, confirmed findings about this exploit.Proposed correction (not yet applied)CryptoDaily's commentary described a generic vulnerability pattern for AMM-style pools -- pricing that 'could be manipulated in a narrow window without enough dynamic fees, TWAP guards, or circuit breakers to resist a flash-loan burst' -- but no cited source confirms that Allbridge Core's pools specifically lacked these three controls or that each failed to trigger during this exploit. - #6[disputed][awaiting moderator]in section: Attack Mechanics
“The nine-step sequence moved faster than the Rebalancer Authority could react.”
reviewerThe nine-step sequence moved faster than the Rebalancer Authority could reactCompounds the unsupported 'nine-step' figure with an unsupported claim about the Rebalancer Authority's specific performance during this incident.Proposed correction (not yet applied)No cited source documents a specific step count for the manipulation or confirms that the Rebalancer Authority was engaged, or too slow, during this attack. - #10[disputed][awaiting moderator]in section: Fund Movements and Attacker Addresses
“Part of the funds were then routed through privacy protocols, including Railgun, NEAR Intents and Zcash Orchard, to hide the trail. This was reported by PeckShield, CertiK, The Defiant and CryptoTimes.”
reviewerStolen funds were routed through privacy protocols including Railgun, NEAR Intents and Zcash OrchardTwo of the four outlets cited for this claim were checked directly and neither names Railgun, NEAR Intents, or Zcash Orchard; both use only generic 'privacy pools' language. The specificity in the page is not traceable to any source this reviewer could access.Proposed correction (not yet applied)Part of the funds were then routed through privacy protocols to hide the trail, though reporting named only generic 'privacy pools' rather than specific protocols. This was reported by PeckShield, CertiK, The Defiant and CryptoTimes. - #11[disputed][awaiting moderator]in the timeline
“Within hours, the stolen funds are bridged from Solana wallet FhffBraZsGn4H2LxLNToEcaHWEfWwT2UcSz4oRHb7Qdc to Ethereum address 0x651591b68A9c9650FB23F642162353306281ffDe, converted to ETH, spread across more addresses, and partly routed through Railgun, NEAR Intents and Zcash Orchard.”
reviewerWithin hours, funds were bridged and partly routed through Railgun, NEAR Intents and Zcash OrchardSame underlying defect as the Fund Movements section -- repeated here in the timeline.Proposed correction (not yet applied)Within hours, the stolen funds are bridged from Solana to an Ethereum address, converted to ETH, spread across more addresses, and partly routed through privacy pools that reporting did not name specifically. - #17[disputed][awaiting moderator]in section: Prior 2023 Exploit and Incomplete Remediation
“According to TechTimes, CryptoTimes, Startup Fortune and GlobalCryptoPress, the fix was applied to the BNB Chain deployment, but the Solana program was never updated and kept running USDC and USDT pools side by side, the exact configuration the single-pool policy was meant to retire.”
reviewerAccording to TechTimes, CryptoTimes, Startup Fortune and GlobalCryptoPress, the single-pool fix was applied to BNB Chain but the Solana program was never updatedTwo of the four cited outlets (CryptoTimes, Startup Fortune) do not address this claim at all when checked directly, and a third (TechTimes) presents it as an open question with multiple possible explanations rather than a settled fact. This overstates the strength and breadth of the sourcing.Proposed correction (not yet applied)According to TechTimes and GlobalCryptoPress, the Solana program kept running USDC and USDT pools side by side -- the exact configuration the single-pool policy was meant to retire -- though neither outlet confirms the fix was in fact applied to the BNB Chain deployment; CryptoTimes and Startup Fortune do not address the single-pool-fix question at all. - #18[disputed][awaiting moderator]in section: Security Audit History and Post-Exploit Analysis
“Allbridge underwent at least five security audits before the July 2026 exploit: Hacken (September 2021), Hacken again (February 2022), Kudelski Security (May 2022), Cossack Labs (September 2022) and CoinFabrik (July 2023, after the first exploit).”
reviewerAllbridge underwent five security audits: Hacken (Sept 2021), Hacken again (Feb 2022), Kudelski Security (May 2022), Cossack Labs (Sept 2022), CoinFabrik (July 2023)No source found (including the page's own citation list, which has no Hacken- or Kudelski-specific URL for this section) confirms a February 2022 Hacken audit or any Kudelski Security engagement with Allbridge; the second Hacken audit this reviewer could find is dated February 2023.Proposed correction (not yet applied)Allbridge underwent at least four documented security audits before the July 2026 exploit: Hacken (September 2021), Hacken again (February 2023), Cossack Labs (September 2022) and CoinFabrik (July 2023, after the first exploit); a Kudelski Security engagement could not be independently confirmed. - #22[disputed][awaiting moderator]in section: Broader Industry Context: Cross-Chain Bridge Vulnerabilities in 2026
“Other July 2026 bridge incidents included the Wanchain and Verus bridge vulnerabilities (a combined $20.5 million) and a Transit Finance exploit ($1.88 million).”
reviewerOther July 2026 bridge incidents included Wanchain/Verus ($20.5M combined) and a Transit Finance exploit ($1.88 million)The Transit Finance exploit is real but took place roughly two months before the period described; grouping it with 'other July 2026 bridge incidents' is a date error.Proposed correction (not yet applied)Other July 2026 bridge incidents included the Wanchain and Verus bridge vulnerabilities (a combined $20.5 million); a separate Transit Finance exploit (about $1.88 million) had occurred in May 2026, not July. - #24[disputed][awaiting moderator]in section: Security Audit History and Post-Exploit Analysis
“As of the reporting window, neither Allbridge nor an independent security firm had published a full technical postmortem explaining why the Rebalancer Authority and other 2023-era protections failed.”
reviewerAs of the reporting window, neither Allbridge nor an independent security firm had published a full technical postmortem explaining why 2023-era protections failedThis is the most consequential finding in the review: an independent firm did publish a technical root-cause analysis within the page's own reporting window, and that analysis is not reflected anywhere on the page, nor does the page's dominant 'ratio manipulation via rapid swaps' narrative match it.Proposed correction (not yet applied)As of the reporting window, Allbridge itself had not published a full technical postmortem explaining why the Rebalancer Authority and other 2023-era protections failed, though the independent security firm BlockSec published a code-level reconstruction on July 30, 2026 attributing the exploit to an account-aliasing flaw in the swap instruction rather than the widely reported flash-loan ratio-manipulation narrative.
unverifiable
2 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #9[unverifiable][awaiting moderator]in section: Fund Movements and Attacker Addresses
“On-chain analysts, including CertiKAlert and Crypto Patel, publicly identified two attacker addresses: the Solana wallet FhffBraZsGn4H2LxLNToEcaHWEfWwT2UcSz4oRHb7Qdc and the Ethereum consolidation address 0x651591b68A9c9650FB23F642162353306281ffDe.”
reviewerOn-chain analysts publicly identified attacker addresses FhffBraZsGn4H2LxLNToEcaHWEfWwT2UcSz4oRHb7Qdc (Solana) and 0x651591b68A9c9650FB23F642162353306281ffDe (Ethereum)No independent news report found names either address, and the primary cited sources are social-media posts this reviewer could not access directly. Not disputed -- just unconfirmed independently. - #12[unverifiable][awaiting moderator]in section: Fund Movements and Attacker Addresses
“Allbridge and its forensic partners traced about $1.63 million of the stolen funds.”
reviewerAllbridge and its forensic partners traced about $1.63 million of the stolen fundsCould not independently confirm this specific figure; not necessarily wrong, just unconfirmed by this review.
partially supported
6 claimsThe cited evidence supports part of the claim but not all of it.
- #3[partially supported][awaiting moderator]in section: Incident Overview
“At the time of the exploit it served about 890,000 wallets and held a TVL of about $21.61 million. After the exploit, TVL fell by more than 40 percent, to about $12.78 million, as liquidity providers withdrew.”
reviewerTVL fell from about $21.61 million to about $12.78 million, a drop of more than 40 percentThe $21.61M-to-$12.78M TVL figures are independently corroborated. The '890,000 wallets' figure could not be found in any source; the closest analogous figure found elsewhere (~838,000 users, undated, from a third-party listing) does not match and measures something different. - #8[partially supported][awaiting moderator]in section: Attack Mechanics
“The single largest related withdrawal reportedly reached $2.24 million in gross USDC before loan repayment, described in one account as an exchange of a few thousand dollars of USDT for about $2.24 million USDC.”
reviewerThe single largest related withdrawal reportedly reached $2.24 million in gross USDC before loan repaymentThe $2.24 million figure is real but the source describes it only as a 'movement,' not with the specific withdrawal/gross framing the page applies; left unverifiable whether the page's added framing is accurate, so no correction proposed given ambiguity. - #14[partially supported][awaiting moderator]in section: Prior 2023 Exploit and Incomplete Remediation
“Allbridge offered the attacker a 10 percent white-hat bounty, and the attacker returned about 1,500 BNB (about $465,000 at the time), which was used to compensate affected users.”
reviewerAllbridge offered the attacker a 10 percent white-hat bountyThe bounty itself and the 1,500 BNB return are well documented, but no source found states a 10 percent figure; the only aggregator headline found cites ~$100,000 (about 17-18% of ~$573K), unconfirmed in its own body text. - #15[partially supported][awaiting moderator]in the timeline
“Allbridge contacts the attacker on-chain, offering a 10 percent white-hat bounty in exchange for the return of the stolen funds.”
reviewerAllbridge contacts the attacker on-chain, offering a 10 percent white-hat bountySame unconfirmed percentage as the corresponding Prior 2023 Exploit section claim. - #16[partially supported][awaiting moderator]in section: Prior 2023 Exploit and Incomplete Remediation
“The postmortem named the main structural defense against flash loans as deploying only a single liquidity pool per blockchain, which it said would make same-transaction flash-loan manipulation 'structurally impossible'; as reported, 'one pool means no sibling pool to swap against, no ratio to distort, and no path for a flash loan to do anything useful.'”
reviewerThe postmortem named a single liquidity pool per blockchain as the main defense and said it would make flash-loan manipulation 'structurally impossible'The page's phrasing implies the postmortem itself used the phrase 'structurally impossible' and that the second quote is a direct report of someone's words ('as reported'); both are instead journalists' own paraphrase/explanation, per the page's own cited sources. - #20[partially supported][awaiting moderator]in section: Security Audit History and Post-Exploit Analysis
“Allbridge Core reportedly raised $2 million in 2022 specifically to fund security audits; public reporting does not say how well those audits covered every chain deployment.”
reviewerAllbridge Core reportedly raised $2 million in 2022 specifically to fund security auditsThe $2 million figure and 2022 date are correct, but the round was for several purposes, not raised specifically/solely for audits.
confirmed
9 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Incident Overview
“On July 19, 2026, at about 17:51 UTC, Allbridge Core's Solana stablecoin liquidity pools were drained in a flash-loan exploit.”
reviewerThe exploit occurred on July 19, 2026 at about 17:51 UTCPrecisely corroborated by an independent technical source (BlockSec), which is notable since most news outlets give only the date, not the time. - #2[confirmed][no action needed]in section: Incident Overview
“PeckShield estimated about $1.65 million, a figure repeated by most outlets and corroborated by CertiK. NFTEvening and Daily Hodl reported about $1.66 million. On-chain analytics service Onchain Lens reported a narrower confirmed on-chain figure of just over $1.1 million at the time of first reporting.”
reviewerLoss estimates range $1.65-1.66 million depending on outlet, with Onchain Lens reporting a narrower ~$1.1 million figureThe page accurately represents genuine divergence across outlets rather than cherry-picking one figure. - #7[confirmed][no action needed]in section: Attack Mechanics
“On-chain data shows a recorded net withdrawal of 948,927.53 USDT from the affected pools.”
reviewerOn-chain data shows a recorded net withdrawal of 948,927.53 USDT from the affected poolsFigure verified in the cited source. - #13[confirmed][no action needed]in section: Prior 2023 Exploit and Incomplete Remediation
“Allbridge Core's first flash-loan exploit hit its BNB Chain stablecoin pools on about April 1–2, 2023, draining about $570,000–$573,000: roughly $289,900 in BUSD and $290,900 in USDT.”
reviewerThe 2023 BNB Chain exploit drained about $570,000-$573,000 (roughly $289,900 BUSD and $290,900 USDT), and the attacker returned about 1,500 BNB (~$465,000)Well corroborated across multiple contemporaneous 2023 sources, including the exact BUSD/USDT split. - #19[confirmed][no action needed]in section: Security Audit History and Post-Exploit Analysis
“Halborn also assessed Allbridge's Bridge and ERC20 contracts between June 17 and July 17, 2024.”
reviewerHalborn assessed Allbridge's Bridge and ERC20 contracts between June 17 and July 17, 2024Exact dates verified directly against the Halborn report. - #21[confirmed][no action needed]in section: Broader Industry Context: Cross-Chain Bridge Vulnerabilities in 2026
“According to NullTX, about $210.3 million was lost across 30 major crypto hacks in July 2026, up 177.2% from $75.87 million the month before.”
reviewerAbout $210.3 million was lost across 30 major crypto hacks in July 2026, up 177.2% from $75.87 million the month beforeFigures verified directly against the cited source. - #23[confirmed][no action needed]in section: Broader Industry Context: Cross-Chain Bridge Vulnerabilities in 2026
“CoinTelegraph described the Allbridge incident as 'at least the sixth attack targeting a cross-chain bridge since May' 2026.”
reviewerCoinTelegraph described the Allbridge incident as at least the sixth attack targeting a cross-chain bridge since May 2026Confirmed. - #25[confirmed][no action needed]in section: Protocol Response and Recovery Efforts
“One report quotes the fuller text as 'Allbridge Core is experiencing a security incident. We have paused the protocol as a precaution while we investigate. If you have liquidity in affected pools, please withdraw now.'”
reviewerAllbridge paused Core, urged withdrawals, and asked arbitrageurs who profited to voluntarily return gainsQuote verified against independent reporting of the same X post. - #26[confirmed][no action needed]in section: Protocol Response and Recovery Efforts
“Allbridge then announced a major architectural change: Allbridge Core and Allbridge Classic would stop operating in their current pool-based form within three months. The new version of Core is planned to remove liquidity pools entirely and route transfers through CCTP (Circle's Cross-Chain Transfer Protocol) and LayerZero, eliminating the pool-imbalance attack surface.”
reviewerAllbridge announced Core and Allbridge Classic will stop pool-based operations within three months, moving to CCTP and LayerZero routingConfirmed by an independent technical source as well as the cited news source.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.