Allbridge Core Solana Flash Loan Exploit (July 2026)
Summary
On July 19–20, 2026, Allbridge Core's Solana deployment suffered a flash loan exploit that drained approximately $1.65 million from stablecoin liquidity pools. An attacker borrowed $1.12 million USDC from Kamino, manipulated pool pricing ratios, and withdrew assets at artificially favorable rates before bridging proceeds to Ethereum. The incident was the second flash loan attack on Allbridge Core, following a nearly identical April 2023 exploit on BNB Chain for which the team had published an architectural fix that was never applied to the Solana deployment.
Connected Entities
2 entities · 10 linked investigations- FhffBraZsGn4H2LxLNToEcaHWEfWwT2UcSz4oRHb7Qdc→mentioned with→Allbridge Core Solana Flash Loan Exploit (July 2026)(50%)
Timeline(7 events)
2023-04-01
Allbridge Core suffered a flash loan exploit on BNB Chain draining approximately $573,000 (approximately $289,900 BUSD and $290,900 USDT). Attacker manipulated swap prices by acting simultaneously as liquidity provider and swapper.
CoinTelegraph / Allbridge Medium postmortem2023-04-01
Allbridge recovered approximately $465,000 of stolen funds through a white-hat arrangement with the attacker and compensated affected users who submitted recovery applications.
Allbridge Medium postmortem2023-05-30
Allbridge published postmortem and relaunched Core with stated fix: single liquidity pool per blockchain, Rebalancer Authority, and automatic circuit-breaker mechanisms. The fix was applied to BNB Chain but the Solana deployment was not correspondingly updated.
Allbridge Medium postmortem / TechTimes2026-07-19
Attacker borrowed approximately $1.12 million USDC from Kamino on Solana, executed rapid USDC/USDT swaps to distort Allbridge Core's Solana pool ratios, withdrew approximately $1.65 million at manipulated rates, and repaid the flash loan within the same transaction.
CoinDesk / Decrypt / CryptoTimes2026-07-19
Stolen funds bridged from Solana (attacker address: FhffBraZsGn4H2LxLNToEcaHWEfWwT2UcSz4oRHb7Qdc) to Ethereum (address: 0x651591b68A9c9650FB23F642162353306281ffDe) and dispersed across additional addresses, with partial routing through privacy pools.
PeckShieldAlert on X / Crypto Patel on X2026-07-20
Allbridge Core paused the protocol and published a public statement advising liquidity providers to withdraw and requesting voluntary return of arbitrage profits from traders who benefited from the manipulation window.
CoinDesk / Decrypt / CoinTelegraph2026-07-20
Allbridge announced a structural redesign of Core: liquidity pools to be removed within three months, with routing switched to CCTP and LayerZero to eliminate the pool-based attack surface.
TechTimes / DecryptDecision Log
- #1publish⛓ pending7/28/2026, 5:32:51 PMhash: 8xDgKQLmm74iJocenP5wPVRsvgdQFqFU6zTpQf38RuXb
14 of 18 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/28/2026, 5:32:40 PM
last updated: 7/28/2026, 9:12:15 PM
avoid.net — verified advice for a post-truth world