Skip to main content
AVOID.NET
Sign in

Allbridge Core — Second Flash Loan Exploit via Same Unpatched Vector

avoid.net/allbridge-core-second-flash-loan-exploit-via-same-unpatched-vector→8/100·82% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·45wgR4…z1Ui

Summary

On July 19–20, 2026, Allbridge Core, a cross-chain bridge protocol, suffered its second flash loan exploit in three years when an attacker borrowed $1.12 million USDC from Solana lending protocol Kamino Finance to manipulate the USDC/USDT stablecoin pool ratios on Solana, ultimately draining approximately $1.65 million. The recurrence of an essentially identical attack vector — price manipulation via flash loan within a single transaction — is particularly notable because Allbridge had publicly committed after the April 2023 exploit to deploying a single liquidity pool per blockchain as its primary structural defense, a measure that was apparently not applied to its Solana deployment.

Connected Entities

1 entities
Organizations
□Allbridge Core — Second Flash Loan Exploit via Same Unpatched Vector
Relationships
    Have evidence about Allbridge Core — Second Flash Loan Exploit via Same Unpatched Vector?
    0
    Accepted
    1
    Under review
    0
    Rejected / revoked

    Community submissions

    Timeline(9 events)

    April 2023

    First Allbridge Core exploit: attacker exploits a withdraw function logic flaw on BNB Chain using flash loans, draining approximately $573,000 from BUSD and USDT pools.

    CryptoTimes / Allbridge Medium postmortem

    3 April 2023

    Allbridge contacts the attacker on-chain offering a 10 percent white-hat bounty in exchange for return of stolen funds.

    Allbridge Medium / CryptoTimes

    4 April 2023

    Attacker returns approximately 1,500 BNB (~$465,000) to Allbridge; protocol uses recovered funds to compensate affected liquidity providers.

    Allbridge Medium postmortem / The Block

    May 2023

    Allbridge publishes postmortem committing to remediation measures including Rebalancer Authority, automatic shutdown mechanism, withdrawal caps, and a single liquidity pool per blockchain as the primary flash loan defense.

    Allbridge Medium (official)

    19 July 2026

    Second flash loan exploit occurs on Allbridge Core's Solana deployment. Attacker borrows $1.12 million USDC from Kamino Finance, manipulates USDC/USDT pool ratios, and drains approximately $1.65 million.

    The Block / CoinDesk / CryptoTimes

    19 July 2026

    Stolen funds bridged from Solana to Ethereum address (0x651...ffDe) by the attacker within hours of the exploit, per PeckShield on-chain analysis.

    CryptoTimes / TradingView / The Block

    19 July 2026

    Funds on Ethereum subsequently routed through privacy protocols, according to multiple security analysts and news outlets.

    The Defiant / CryptoTimes

    20 July 2026

    Allbridge Core issues public statement confirming exploit and pausing the protocol. Team urges liquidity providers to withdraw from affected pools and asks arbitrageurs who profited from the price distortion to voluntarily return funds.

    CoinDesk / The Block / Yahoo Finance

    20 July 2026

    PeckShield and CertiK independently confirm the exploit; Allbridge Core TVL falls from approximately $21.61 million to $12.78 million as liquidity providers withdraw.

    AMBCrypto / CryptoDaily / Blockzeit
    Provenance & Audit Trail
    Anchored on SolanaVerify on-chain16 Wayback Archives

    Decision Log

    This investigation is cryptographically anchored to the Solana blockchain (3 events). 16 of 17 cited source URLs have an Internet Archive snapshot.

    full audit log →version history →

    model: claude-sonnet-4-6

    generated: 8/1/2026, 11:19:52 PM

    last updated: 8/26/2026, 3:36:28 PM

    4 views

    avoid.net — verified advice for a post-truth world