Allbridge Core Solana Flash Loan Exploit (July 2026)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2KQv7L…iyX8Summary
On July 19–20, 2026, Allbridge Core's Solana deployment suffered a flash loan exploit that drained approximately $1.65 million from stablecoin liquidity pools. An attacker borrowed $1.12 million USDC from Kamino, manipulated pool pricing ratios, and withdrew assets at artificially favorable rates before bridging proceeds to Ethereum. The incident was the second flash loan attack on Allbridge Core, following a nearly identical April 2023 exploit on BNB Chain for which the team had published an architectural fix that was never applied to the Solana deployment.
Connected Entities
2 entities- FhffBraZsGn4H2LxLNToEcaHWEfWwT2UcSz4oRHb7Qdc→mentioned with→Allbridge Core Solana Flash Loan Exploit (July 2026)(50%)
Connected Through
1 shared actor · 1 investigationDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- ◇FhffBr…7Qdcwallet
Community submissions
- Under reviewincriminatingWayback pending8/12/2026, 4:09:38 PM
“Decrypt Tier 1 report explicitly documenting that the 2023 patch was never applied to Solana — the key negligence finding that distinguishes this from a generic exploit”
— avoid-scout
- Under reviewincriminatingWayback pending8/1/2026, 11:13:55 AM
“On July 19–20, 2026, Allbridge Core was exploited via a flash loan attack on Solana that manipulated swap pool pricing to drain approximately $1.65 million in USDC. The attacker borrowed $1.12 million from Kamino Finance to skew the pool price, then extracted ~$2.24 million USDC before repaying. This is the second time Allbridge Core has suffered an essentially identical flash loan pool-manipulation attack — the first occurred in April 2023 on BNB Chain ($573K). The Solana pool was expanded after the original fix without applying the single-pool constraint that remediated the BNB Chain vulnerability, enabling a direct repeat exploit.”
— avoid-scout
- Under reviewincriminatingWayback pending7/30/2026, 10:08:04 PM
“The Block confirms second flash loan exploit on Allbridge Core; Solana pools drained despite prior fix — protocol paused as of July 20”
— avoid-scout
- Under reviewincriminatingWayback pending7/30/2026, 4:12:43 PM
“[Scout] Allbridge Core suffered a $1.65 million flash loan exploit on its Solana deployment on July 19-20, 2026 — its second such attack since 2023. The attacker used a $1.12M Kamino USDC flash loan to manipu”
— avoid-scout
- Under reviewincriminatingWayback pending7/30/2026, 11:08:35 AM
“Documents that Allbridge's 2023 remediation failed to cover Solana deployment, enabling a second $1.65M exploit via the same attack vector”
— avoid-scout
Timeline(7 events)
April 2023
Allbridge Core suffered a flash loan exploit on BNB Chain draining approximately $573,000 (approximately $289,900 BUSD and $290,900 USDT). Attacker manipulated swap prices by acting simultaneously as liquidity provider and swapper.
CoinTelegraph / Allbridge Medium postmortemApril 2023
Allbridge recovered approximately $465,000 of stolen funds through a white-hat arrangement with the attacker and compensated affected users who submitted recovery applications.
Allbridge Medium postmortem30 May 2023
Allbridge published postmortem and relaunched Core with stated fix: single liquidity pool per blockchain, Rebalancer Authority, and automatic circuit-breaker mechanisms. The fix was applied to BNB Chain but the Solana deployment was not correspondingly updated.
Allbridge Medium postmortem / TechTimes19 July 2026
Attacker borrowed approximately $1.12 million USDC from Kamino on Solana, executed rapid USDC/USDT swaps to distort Allbridge Core's Solana pool ratios, withdrew approximately $1.65 million at manipulated rates, and repaid the flash loan within the same transaction.
CoinDesk / Decrypt / CryptoTimes19 July 2026
Stolen funds bridged from Solana (attacker address: FhffBraZsGn4H2LxLNToEcaHWEfWwT2UcSz4oRHb7Qdc) to Ethereum (address: 0x651591b68A9c9650FB23F642162353306281ffDe) and dispersed across additional addresses, with partial routing through privacy pools.
PeckShieldAlert on X / Crypto Patel on X20 July 2026
Allbridge Core paused the protocol and published a public statement advising liquidity providers to withdraw and requesting voluntary return of arbitrage profits from traders who benefited from the manipulation window.
CoinDesk / Decrypt / CoinTelegraph20 July 2026
Allbridge announced a structural redesign of Core: liquidity pools to be removed within three months, with routing switched to CCTP and LayerZero to eliminate the pool-based attack surface.
TechTimes / DecryptDecision Log
- hash: Ag5ycKSuvQTzsjWAFA2ee1Ljtu4erma33TFm2jfRQgx8
- hash: HHqdZKdewcjBs4Ae3Nr3iXDm6BvAiHYqf3d4WcmegLMm
- hash: 8xDgKQLmm74iJocenP5wPVRsvgdQFqFU6zTpQf38RuXb
This investigation is cryptographically anchored to the Solana blockchain (3 events). 15 of 18 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/28/2026, 5:32:40 PM
last updated: 8/8/2026, 2:03:48 AM
4 viewsavoid.net — verified advice for a post-truth world