Audit log

Every state-changing event for Allbridge Core — Second Flash Loan Exploit via Same Unpatched Vector: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-01 23:19:56Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   5aj5iALmp4mE…6vjo7GqScopysha256 → base58

   verifying row…

   canonical bytes (22999 B) ▸

   {"actor":"system:backfill","investigation_id":"e3ad1666-117b-460f-add3-88e6cde00c95","kind":"publish","page_slug":"allbridge-core-second-flash-loan-exploit-via-same-unpatched-vector","published_at":"2026-08-01T23:19:56.639Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Allbridge Core — Second Flash Loan Exploit via Same Unpatched Vector","sections":[{"content":"Allbridge Core paused its cross-chain protocol on July 20, 2026, following an exploit on its Solana deployment estimated by blockchain security firm PeckShield at approximately $1.65 million. On-chain analytics service Onchain Lens reported a narrower confirmed on-chain figure exceeding $1.1 million at the time of initial reporting. The discrepancy between the two figures reflects differing methodologies: PeckShield's estimate incorporates indirect losses from pool imbalance and liquidity distortion, while Onchain Lens focused on directly attributable token outflows. Both CertiK and PeckShield confirmed the exploit independently. The attack caused Allbridge Core's total value locked (TVL) to fall sharply from approximately $21.61 million to roughly $12.78 million — a decline of more than 40 percent — as liquidity providers withdrew positions in the aftermath.","heading":"Incident Overview","severity":"critical","sources":[{"credibility":1,"name":"Allbridge Core pauses protocol after $1.65 million flash loan exploit: onchain analysts — The Block","type":"news_article","url":"https://www.theblock.co/post/408855/allbridge-core-exploit"},{"credibility":1,"name":"Cross-chain protocol Allbridge halts after $1.65 million flash loan exploit — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/07/20/cross-chain-protocol-allbridge-halts-after-usd1-65-million-flash-loan-exploit"},{"credibility":2,"name":"Allbridge exploit: Flash loans still haunt DeFi — $1.65M drained via USDC/USDT pool — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/allbridge-exploit-flash-loans-still-haunt-defi-1-65m-drained-via-usdc-usdt-pool/"},{"credibility":2,"name":"Allbridge Core Pauses After $1.65M Flash-Loan Exploit — CryptoDaily","type":"news_article","url":"https://cryptodaily.co.uk/2026/07/allbridge-core-pauses-flash-loan-exploit"}]},{"content":"The exploit followed a flash loan price manipulation pattern targeting Allbridge Core's native-liquidity model on Solana. Allbridge Core prices liquidity withdrawals based on the internal ratio between USDC and USDT held within its own pools — a design that creates exposure to intra-transaction ratio manipulation. The attacker obtained a $1.12 million USDC flash loan from Kamino Finance, a Solana-based lending and liquidity protocol. Using this capital, the attacker executed a burst of rapid USDC-to-USDT swaps within the Allbridge pool, artificially skewing the internal ratio between the two stablecoins. This distortion allowed the attacker to withdraw liquidity at a manipulated exchange rate favoring their position. After extracting the proceeds, the attacker repaid the Kamino flash loan within the same transaction, retaining the difference as profit. The single largest withdrawal tied to the exploit reportedly reached $2.24 million in USDC gross proceeds before flash loan repayment costs. The attacker was also reported to have extracted approximately 948,927.53 USDT through the manipulated ratio. Kamino Finance itself was not compromised; it functioned as the capital source for the flash loan in its intended capacity.","heading":"Attack Mechanism","severity":"critical","sources":[{"credibility":2,"name":"Allbridge Core Hit by $1.65M Solana Flash-Loan Exploit, Its Second Since 2023 — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/20/allbridge-core-hit-by-1-65m-solana-flash-loan-exploit-its-second-since-2023/"},{"credibility":2,"name":"Allbridge Core Loses $1.65 Million to the Same Flash Loan Trick Twice — Startup Fortune","type":"news_article","url":"https://startupfortune.com/allbridge-core-loses-165-million-to-the-same-flash-loan-trick-twice/"},{"credibility":2,"name":"Allbridge exploit: Flash loans still haunt DeFi — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/allbridge-exploit-flash-loans-still-haunt-defi-1-65m-drained-via-usdc-usdt-pool/"},{"credibility":1,"name":"Allbridge Core pauses protocol after $1.65 million flash loan exploit — The Block","type":"news_article","url":"https://www.theblock.co/post/408855/allbridge-core-exploit"}]},{"content":"This was the second documented flash loan exploit targeting Allbridge Core. The first occurred on April 1–2, 2023, on BNB Chain, when an attacker exploited a logic flaw in the withdraw function by acting as both liquidity provider and swapper, manipulating swap pricing through a smart contract vulnerability and draining approximately $573,000 from BUSD and USDT pools. Following that incident, Allbridge published a postmortem and committed to several remediations: corrected liquidity calculations, withdrawal caps tied to LP token balances, an automatic pool shutdown mechanism for extreme imbalances, and the addition of a Rebalancer Authority emergency account capable of correcting pool imbalances without paying fees. Crucially, the postmortem also identified that the primary structural defense against flash loan attacks would be deploying a single liquidity pool per blockchain — a measure that would make same-transaction flash loan manipulation structurally impossible by eliminating the multi-pool ratio that the attack exploits. According to multiple reports covering the July 2026 incident, the single-pool-per-blockchain commitment was not fulfilled on Solana: the exploited configuration involved a USDC and a USDT pool operating side by side — precisely the multi-stablecoin architecture the 2023 remediation was meant to eliminate. TechTimes and CryptoTimes both reported that the single-pool fix explicitly missed Solana. The Rebalancer Authority that was deployed also failed to prevent the attack. Allbridge's 2023 postmortem was published on the official Allbridge Medium account and committed to open-sourcing EVM and Tron contract repositories to invite external security review.","heading":"Incomplete Remediation After 2023 Exploit","severity":"critical","sources":[{"credibility":2,"name":"Allbridge Core Loses $1.65M to Flash Loan Again After Its Single-Pool Fix Missed Solana — TechTimes","type":"news_article","url":"https://www.techtimes.com/articles/321044/20260720/allbridge-core-loses-165m-flash-loan-again-after-its-single-pool-fix-missed-solana.htm"},{"credibility":2,"name":"Allbridge Core Hit by $1.65M Solana Flash-Loan Exploit, Its Second Since 2023 — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/20/allbridge-core-hit-by-1-65m-solana-flash-loan-exploit-its-second-since-2023/"},{"credibility":1,"name":"Allbridge Core Updates Following the Relaunch — Official Allbridge Medium","type":"official","url":"https://allbridge.medium.com/allbridge-core-updates-following-the-relaunch-9f7716eeb5da"},{"credibility":2,"name":"Allbridge Core Loses $1.65 Million to the Same Flash Loan Trick Twice — Startup Fortune","type":"news_article","url":"https://startupfortune.com/allbridge-core-loses-165-million-to-the-same-flash-loan-trick-twice/"}]},{"content":"Following the exploit, the attacker bridged the stolen funds from Solana to an Ethereum address (reported as beginning with 0x651 and ending in ffDe, per PeckShield's on-chain analysis) within hours of the attack. The funds were subsequently dispersed across multiple addresses on Ethereum and a portion was reported to have been routed through privacy protocols to obscure the trail. The The Defiant and CryptoTimes both noted that proceeds were routed toward privacy pools to frustrate tracing efforts. The exact amount remaining under attacker control at time of publication was not confirmed, as the funds continued to move.","heading":"Fund Movement and Laundering","severity":"high","sources":[{"credibility":2,"name":"Allbridge Core Hit by $1.65M Solana Flash-Loan Exploit, Its Second Since 2023 — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/20/allbridge-core-hit-by-1-65m-solana-flash-loan-exploit-its-second-since-2023/"},{"credibility":2,"name":"Allbridge Halts Core Bridge After $1.65M Flash Loan Exploit — The Defiant","type":"news_article","url":"https://thedefiant.io/news/hacks/allbridge-halts-core-bridge-after-1-65m-flash-loan-exploit"},{"credibility":2,"name":"Allbridge Core Hit by $1.65M Solana Exploit, Funds Traced to Ethereum — CryptoTimes via TradingView","type":"on_chain","url":"https://www.tradingview.com/news/coinpedia:19f5bacbd094b:0-allbridge-core-hit-by-1-65m-solana-exploit-funds-traced-to-ethereum/"}]},{"content":"Allbridge paused the Core bridge following the exploit and issued a public statement that 'Allbridge Core is experiencing a security incident, and the protocol has been paused as a precaution.' The team directed liquidity providers to withdraw from affected pools immediately. Allbridge also appealed to arbitrage traders who had profited from the temporary pool price imbalance created by the attacker's manipulation — asking them to voluntarily return those gains to a designated address for distribution to affected liquidity providers. This voluntary recovery mechanism mirrors the approach used after the 2023 exploit, when the original attacker was offered a 10 percent white-hat bounty in exchange for returning funds; the attacker ultimately returned approximately 1,500 BNB (valued at roughly $465,000 at the time). As of the reporting date, no formal postmortem had been published for the July 2026 incident, and no confirmed compensation timeline or total affected balance had been disclosed by the protocol. Allbridge Core indicated its intent to compensate affected liquidity providers but did not provide binding commitments at publication.","heading":"Protocol Response and Recovery Efforts","severity":"high","sources":[{"credibility":1,"name":"Cross-chain protocol Allbridge halts after $1.65 million flash loan exploit — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/07/20/cross-chain-protocol-allbridge-halts-after-usd1-65-million-flash-loan-exploit"},{"credibility":2,"name":"Allbridge Core Pauses After $1.65M Flash-Loan Exploit — CryptoDaily","type":"news_article","url":"https://cryptodaily.co.uk/2026/07/allbridge-core-pauses-flash-loan-exploit"},{"credibility":2,"name":"Allbridge Core Pauses Protocol After Attacker Drains More Than $1 Million — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/allbridge-core-pauses-protocol-attacker-023505603.html"},{"credibility":1,"name":"Allbridge Core Updates Following the Relaunch — Official Allbridge Medium","type":"official","url":"https://allbridge.medium.com/allbridge-core-updates-following-the-relaunch-9f7716eeb5da"}]},{"content":"PeckShield and CertiK both independently confirmed the exploit and its mechanism shortly after it occurred. PeckShield estimated total losses at approximately $1.65 million and identified the Ethereum address to which funds were bridged. Onchain Lens provided transaction-level detail via Solscan documentation and reported over $1.1 million in directly confirmed on-chain outflows. The discrepancy between Onchain Lens's figure and PeckShield's higher estimate has not been formally reconciled in publicly available reporting as of the date of this investigation. No comprehensive technical postmortem or audit report addressing the root cause of the July 2026 attack's success — specifically why the Rebalancer Authority and other 2023-era protections failed — had been published by Allbridge or an independent security firm at the time sources were gathered.","heading":"Security Firm Analysis","severity":"medium","sources":[{"credibility":1,"name":"Allbridge Core pauses protocol after $1.65 million flash loan exploit — The Block","type":"news_article","url":"https://www.theblock.co/post/408855/allbridge-core-exploit"},{"credibility":2,"name":"Allbridge Core Hit by $1.65M Solana Flash-Loan Exploit, Its Second Since 2023 — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/20/allbridge-core-hit-by-1-65m-solana-flash-loan-exploit-its-second-since-2023/"},{"credibility":2,"name":"Allbridge Core Confirms Exploit, Losses Estimated Around $1.65M — Blockzeit","type":"news_article","url":"https://blockzeit.com/allbridge-core-exploit-losses-estimated-at-around-1-65m/"}]},{"content":"The July 2026 exploit is the second confirmed flash loan attack against Allbridge Core in three years and the second involving manipulation of a multi-stablecoin pool ratio. The first incident in April 2023 targeted BNB Chain pools and exploited a logic flaw in the withdraw function. The July 2026 incident targeted Solana pools using a nearly identical technique: flash-loan-funded intra-transaction ratio manipulation. The recurrence raises questions about the completeness of post-exploit audits and the protocol's chain-by-chain patch deployment consistency. Allbridge's public 2023 postmortem committed to a single-pool-per-blockchain architecture as the primary defense; the 2026 Solana pools retained a multi-stablecoin configuration inconsistent with that commitment. The pattern suggests either that the architectural commitment was not uniformly implemented across all supported chains, that Solana was explicitly or inadvertently excluded from the remediation scope, or that the single-pool architecture was subsequently reversed for Solana. Allbridge has not published an explanation for this discrepancy as of reporting date. This investigative page reflects the state of publicly available information as of August 2026. No regulatory filings, law enforcement actions, or civil litigation related to the July 2026 incident have been identified.","heading":"Historical Pattern and Risk Assessment","severity":"critical","sources":[{"credibility":2,"name":"Allbridge Core Loses $1.65M to Flash Loan Again After Its Single-Pool Fix Missed Solana — TechTimes","type":"news_article","url":"https://www.techtimes.com/articles/321044/20260720/allbridge-core-loses-165m-flash-loan-again-after-its-single-pool-fix-missed-solana.htm"},{"credibility":2,"name":"Allbridge Flash Loan Attack Drains $1.65M — For the Second Time — Cryptonomist","type":"news_article","url":"https://en.cryptonomist.ch/2026/07/20/allbridge-flash-loan-attack/"},{"credibility":1,"name":"Allbridge Core Updates Following the Relaunch — Official Allbridge Medium","type":"official","url":"https://allbridge.medium.com/allbridge-core-updates-following-the-relaunch-9f7716eeb5da"},{"credibility":1,"name":"Allbridge Pauses Cross-Chain Protocol After $1.65M Flash Loan Attack — Decrypt","type":"news_article","url":"https://decrypt.co/373831/allbridge-pauses-cross-chain-protocol-after-1-65m-flash-loan-attack"}]}],"sources_used":[{"credibility":1,"name":"Allbridge Core pauses protocol after $1.65 million flash loan exploit — The Block","type":"news_article","url":"https://www.theblock.co/post/408855/allbridge-core-exploit"},{"credibility":1,"name":"Cross-chain protocol Allbridge halts after $1.65 million flash loan exploit — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/07/20/cross-chain-protocol-allbridge-halts-after-usd1-65-million-flash-loan-exploit"},{"credibility":1,"name":"Allbridge Pauses Cross-Chain Protocol After $1.65M Flash Loan Attack — Decrypt","type":"news_article","url":"https://decrypt.co/373831/allbridge-pauses-cross-chain-protocol-after-1-65m-flash-loan-attack"},{"credibility":1,"name":"Allbridge Core Updates Following the Relaunch — Official Allbridge Medium","type":"official","url":"https://allbridge.medium.com/allbridge-core-updates-following-the-relaunch-9f7716eeb5da"},{"credibility":2,"name":"Allbridge Core Hit by $1.65M Solana Flash-Loan Exploit, Its Second Since 2023 — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/20/allbridge-core-hit-by-1-65m-solana-flash-loan-exploit-its-second-since-2023/"},{"credibility":2,"name":"Allbridge Core Loses $1.65M to Flash Loan Again After Its Single-Pool Fix Missed Solana — TechTimes","type":"news_article","url":"https://www.techtimes.com/articles/321044/20260720/allbridge-core-loses-165m-flash-loan-again-after-its-single-pool-fix-missed-solana.htm"},{"credibility":2,"name":"Allbridge Core Loses $1.65 Million to the Same Flash Loan Trick Twice — Startup Fortune","type":"news_article","url":"https://startupfortune.com/allbridge-core-loses-165-million-to-the-same-flash-loan-trick-twice/"},{"credibility":2,"name":"Allbridge Halts Core Bridge After $1.65M Flash Loan Exploit — The Defiant","type":"news_article","url":"https://thedefiant.io/news/hacks/allbridge-halts-core-bridge-after-1-65m-flash-loan-exploit"},{"credibility":2,"name":"Allbridge Flash Loan Attack Drains $1.65M — For the Second Time — Cryptonomist","type":"news_article","url":"https://en.cryptonomist.ch/2026/07/20/allbridge-flash-loan-attack/"},{"credibility":2,"name":"Allbridge exploit: Flash loans still haunt DeFi — $1.65M drained via USDC/USDT pool — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/allbridge-exploit-flash-loans-still-haunt-defi-1-65m-drained-via-usdc-usdt-pool/"},{"credibility":2,"name":"Allbridge Core Pauses After $1.65M Flash-Loan Exploit — CryptoDaily","type":"news_article","url":"https://cryptodaily.co.uk/2026/07/allbridge-core-pauses-flash-loan-exploit"},{"credibility":2,"name":"Allbridge Flash-Loan Exploit: How Pool Manipulation Drained $1.65 Million — CryptoDaily","type":"news_article","url":"https://cryptodaily.co.uk/2026/07/allbridge-flash-loan-exploit-pool-manipulation"},{"credibility":2,"name":"Allbridge Confirms Core Exploit, Losses Estimated Around $1.65M — Blockzeit","type":"news_article","url":"https://blockzeit.com/allbridge-core-exploit-losses-estimated-at-around-1-65m/"},{"credibility":2,"name":"Allbridge Core Pauses Protocol After Attacker Drains More Than $1 Million — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/allbridge-core-pauses-protocol-attacker-023505603.html"},{"credibility":2,"name":"Allbridge Core Hit by $1.65M Solana Exploit, Funds Traced to Ethereum — TradingView/Coinpedia","type":"on_chain","url":"https://www.tradingview.com/news/coinpedia:19f5bacbd094b:0-allbridge-core-hit-by-1-65m-solana-exploit-funds-traced-to-ethereum/"},{"credibility":2,"name":"Allbridge Suspends Core Protocol After $1.65M Solana Flash Loan Exploit — CryptoRank","type":"news_article","url":"https://cryptorank.io/news/feed/605e8-allbridge-suspends-core-protocol-after-1-65m-solana-flash-loan-exploit"},{"credibility":2,"name":"Allbridge Core halted after $1.65M Solana exploit — Crypto.news","type":"news_article","url":"https://crypto.news/allbridge-core-halted-after-1-65m-solana-exploit/"}],"summary":"On July 19–20, 2026, Allbridge Core, a cross-chain bridge protocol, suffered its second flash loan exploit in three years when an attacker borrowed $1.12 million USDC from Solana lending protocol Kamino Finance to manipulate the USDC/USDT stablecoin pool ratios on Solana, ultimately draining approximately $1.65 million. The recurrence of an essentially identical attack vector — price manipulation via flash loan within a single transaction — is particularly notable because Allbridge had publicly committed after the April 2023 exploit to deploying a single liquidity pool per blockchain as its primary structural defense, a measure that was apparently not applied to its Solana deployment.","timeline":[{"date":"2023-04-01","event":"First Allbridge Core exploit: attacker exploits a withdraw function logic flaw on BNB Chain using flash loans, draining approximately $573,000 from BUSD and USDT pools.","source":"CryptoTimes / Allbridge Medium postmortem","source_url":"https://www.cryptotimes.io/2026/07/20/allbridge-core-hit-by-1-65m-solana-flash-loan-exploit-its-second-since-2023/"},{"date":"2023-04-03","event":"Allbridge contacts the attacker on-chain offering a 10 percent white-hat bounty in exchange for return of stolen funds.","source":"Allbridge Medium / CryptoTimes","source_url":"https://allbridge.medium.com/allbridge-core-updates-following-the-relaunch-9f7716eeb5da"},{"date":"2023-04-04","event":"Attacker returns approximately 1,500 BNB (~$465,000) to Allbridge; protocol uses recovered funds to compensate affected liquidity providers.","source":"Allbridge Medium postmortem / The Block","source_url":"https://allbridge.medium.com/allbridge-core-updates-following-the-relaunch-9f7716eeb5da"},{"date":"2023-05-01","event":"Allbridge publishes postmortem committing to remediation measures including Rebalancer Authority, automatic shutdown mechanism, withdrawal caps, and a single liquidity pool per blockchain as the primary flash loan defense.","source":"Allbridge Medium (official)","source_url":"https://allbridge.medium.com/allbridge-core-updates-following-the-relaunch-9f7716eeb5da"},{"date":"2026-07-19","event":"Second flash loan exploit occurs on Allbridge Core's Solana deployment. Attacker borrows $1.12 million USDC from Kamino Finance, manipulates USDC/USDT pool ratios, and drains approximately $1.65 million.","source":"The Block / CoinDesk / CryptoTimes","source_url":"https://www.theblock.co/post/408855/allbridge-core-exploit"},{"date":"2026-07-19","event":"Stolen funds bridged from Solana to Ethereum address (0x651...ffDe) by the attacker within hours of the exploit, per PeckShield on-chain analysis.","source":"CryptoTimes / TradingView / The Block","source_url":"https://www.cryptotimes.io/2026/07/20/allbridge-core-hit-by-1-65m-solana-flash-loan-exploit-its-second-since-2023/"},{"date":"2026-07-19","event":"Funds on Ethereum subsequently routed through privacy protocols, according to multiple security analysts and news outlets.","source":"The Defiant / CryptoTimes","source_url":"https://thedefiant.io/news/hacks/allbridge-halts-core-bridge-after-1-65m-flash-loan-exploit"},{"date":"2026-07-20","event":"Allbridge Core issues public statement confirming exploit and pausing the protocol. Team urges liquidity providers to withdraw from affected pools and asks arbitrageurs who profited from the price distortion to voluntarily return funds.","source":"CoinDesk / The Block / Yahoo Finance","source_url":"https://www.coindesk.com/business/2026/07/20/cross-chain-protocol-allbridge-halts-after-usd1-65-million-flash-loan-exploit"},{"date":"2026-07-20","event":"PeckShield and CertiK independently confirm the exploit; Allbridge Core TVL falls from approximately $21.61 million to $12.78 million as liquidity providers withdraw.","source":"AMBCrypto / CryptoDaily / Blockzeit","source_url":"https://ambcrypto.com/allbridge-exploit-flash-loans-still-haunt-defi-1-65m-drained-via-usdc-usdt-pool/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 8aaf2b36-d54d-4168-a520-ceb807f89d17copy