Allbridge Core — Second Flash Loan Exploit via Same Unpatched Vector

2023-04-01

First Allbridge Core exploit: attacker exploits a withdraw function logic flaw on BNB Chain using flash loans, draining approximately $573,000 from BUSD and USDT pools.

2023-04-03

Allbridge contacts the attacker on-chain offering a 10 percent white-hat bounty in exchange for return of stolen funds.

2023-04-04

Attacker returns approximately 1,500 BNB (~$465,000) to Allbridge; protocol uses recovered funds to compensate affected liquidity providers.

2023-05-01

Allbridge publishes postmortem committing to remediation measures including Rebalancer Authority, automatic shutdown mechanism, withdrawal caps, and a single liquidity pool per blockchain as the primary flash loan defense.

2026-07-19

Second flash loan exploit occurs on Allbridge Core's Solana deployment. Attacker borrows $1.12 million USDC from Kamino Finance, manipulates USDC/USDT pool ratios, and drains approximately $1.65 million.

2026-07-19

Stolen funds bridged from Solana to Ethereum address (0x651...ffDe) by the attacker within hours of the exploit, per PeckShield on-chain analysis.

2026-07-19

Funds on Ethereum subsequently routed through privacy protocols, according to multiple security analysts and news outlets.

2026-07-20

Allbridge Core issues public statement confirming exploit and pausing the protocol. Team urges liquidity providers to withdraw from affected pools and asks arbitrageurs who profited from the price distortion to voluntarily return funds.

2026-07-20

PeckShield and CertiK independently confirm the exploit; Allbridge Core TVL falls from approximately $21.61 million to $12.78 million as liquidity providers withdraw.