Audit log

Every state-changing event for Allbridge Core Solana Flash Loan Exploit (July 2026): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-07-28 17:32:51Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   8xDgKQLmm74i…Qf38RuXbcopysha256 → base58

   verifying row…

   canonical bytes (19166 B) ▸

   {"actor":"system:backfill","investigation_id":"faec5800-9619-42f7-95f7-64b6ca22289d","kind":"publish","page_slug":"allbridge-core-solana-flash-loan-exploit-july-2026","published_at":"2026-07-28T17:32:51.031Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Allbridge Core Solana Flash Loan Exploit (July 2026)","sections":[{"content":"On July 19–20, 2026, Allbridge Core, a cross-chain stablecoin bridge protocol, paused all operations after an attacker exploited its Solana liquidity pools for approximately $1.65 million. The protocol was immediately halted for investigation. The team issued a public statement: 'Allbridge Core is experiencing a security incident. We have paused the protocol as a precaution while we investigate. If you have liquidity in affected pools, please withdraw now.' Security firms PeckShield and CertiK flagged the exploit on-chain shortly after it occurred. The attack represented the second flash loan exploit in the protocol's history, the first having occurred in April 2023 on Allbridge's BNB Chain pools.","heading":"Incident Overview","severity":"critical","sources":[{"credibility":1,"name":"Cross-chain protocol Allbridge halts after $1.65 million flash loan exploit — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/07/20/cross-chain-protocol-allbridge-halts-after-usd1-65-million-flash-loan-exploit"},{"credibility":1,"name":"Allbridge Core pauses protocol after $1.65 million flash loan exploit — The Block","type":"news_article","url":"https://www.theblock.co/post/408855/allbridge-core-exploit"},{"credibility":2,"name":"Allbridge Core Pauses After $1.65M Flash-Loan Exploit — CryptoDaily","type":"news_article","url":"https://cryptodaily.co.uk/2026/07/allbridge-core-pauses-flash-loan-exploit"},{"credibility":3,"name":"PeckShieldAlert on X — exploit flagged on-chain","type":"social_media","url":"https://x.com/PeckShieldAlert/status/2079011150713561173"}]},{"content":"The attacker borrowed approximately $1.12 million in USDC via a flash loan from Kamino, a Solana-based lending protocol. Using the borrowed capital, the attacker executed rapid alternating swaps between USDC and USDT within Allbridge Core's Solana stablecoin pools. These swaps distorted the pool's internal pricing ratios away from their near-1:1 parity, a property maintained by curve-based invariants designed for stablecoin pools with low slippage. Once the ratios were sufficiently distorted, the attacker exploited Allbridge's withdrawal pricing logic — which relied on the manipulated pool ratios — to withdraw liquidity at artificially favorable rates. The flash loan was then repaid within the same transaction window, with the attacker retaining the spread as profit. One documented transaction involved an exchange of a few thousand dollars of USDT for approximately $2.24 million in USDC through Allbridge, with a recorded net withdrawal of 948,927.53 USDT from the affected pools. Security analysts attributed the exploit's success to insufficient dynamic fee mechanisms, time-weighted average price (TWAP) guards, and circuit breakers on the Solana deployment.","heading":"Attack Mechanics","severity":"critical","sources":[{"credibility":2,"name":"Inside the Allbridge Flash-Loan Exploit on Solana — CryptoDaily","type":"news_article","url":"https://cryptodaily.co.uk/2026/07/allbridge-flash-loan-exploit-pool-manipulation"},{"credibility":2,"name":"Allbridge Core Hit by $1.65M Solana Flash-Loan Exploit, Its Second Since 2023 — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/20/allbridge-core-hit-by-1-65m-solana-flash-loan-exploit-its-second-since-2023/"},{"credibility":2,"name":"Allbridge Pauses Cross-Chain Protocol After $1.65M Flash Loan Attack — Decrypt","type":"news_article","url":"https://decrypt.co/373831/allbridge-pauses-cross-chain-protocol-after-1-65m-flash-loan-attack"}]},{"content":"On-chain analysts identified two wallet addresses associated with the attacker. The Solana-side address was identified as FhffBraZsGn4H2LxLNToEcaHWEfWwT2UcSz4oRHb7Qdc. Stolen assets were subsequently bridged from Solana to an Ethereum address identified as 0x651591b68A9c9650FB23F642162353306281ffDe. Following the cross-chain transfer, the attacker dispersed funds across multiple additional Ethereum addresses. Security firms PeckShield and CertiK reported that the stolen proceeds were partially routed through privacy pools, a common technique used to obscure on-chain tracing efforts. The exact final disposition of all funds remained unclear at the time of initial reporting.","heading":"Attacker Addresses and Fund Movement","severity":"high","sources":[{"credibility":3,"name":"Crypto Patel on X — attacker wallet addresses identified","type":"social_media","url":"https://x.com/CryptoPatel/status/2079106282083205557"},{"credibility":3,"name":"PeckShieldAlert on X — funds bridged Solana to Ethereum","type":"social_media","url":"https://x.com/PeckShieldAlert/status/2079011150713561173"},{"credibility":2,"name":"Allbridge Core Hit by $1.65M Solana Exploit, Funds Traced to Ethereum — Coinpedia","type":"news_article","url":"https://coinpedia.org/news/allbridge-core-hit-by-1-65m-solana-exploit-funds-traced-to-ethereum/"}]},{"content":"The July 2026 incident was structurally nearly identical to a flash loan attack Allbridge Core suffered on its BNB Chain deployment on approximately April 1–2, 2023. In the 2023 incident, an attacker acting simultaneously as liquidity provider and swapper manipulated swap prices in Allbridge's vUSD minting logic, draining approximately $573,000 — approximately $289,900 in BUSD and $290,900 in USDT. Allbridge subsequently negotiated a white-hat arrangement and recovered approximately $465,000 of the stolen funds. On May 30, 2023, Allbridge published a detailed postmortem committing to a specific architectural remedy: deploying a single liquidity pool per blockchain, on the stated basis that 'one pool means no sibling pool to swap against, no ratio to distort, and no path for a flash loan to do anything useful.' The 2023 postmortem also introduced a Rebalancer Authority, automatic circuit-breaker mechanisms for pool imbalances, and enhanced manual emergency controls. However, investigators and analysts determined that the 2023 BNB Chain fix applied pool-ratio invariant checks only to that deployment; the Solana program was never correspondingly updated and continued to run USDC and USDT pools side-by-side — the exact multi-stablecoin pool configuration the single-pool policy was intended to retire. As one analysis concluded: 'a security commitment that existed in a blog post did not exist in the code on at least one chain, and there was apparently no process catching the gap.'","heading":"Prior Exploit and Failure of 2023 Remediation","severity":"critical","sources":[{"credibility":2,"name":"The Hack They Called 'Structurally Impossible' in 2023 Just Cost Them $1.65M — GlobalCryptoPress","type":"news_article","url":"https://www.globalcryptopress.com/2026/07/the-hack-they-called-structurally.html"},{"credibility":2,"name":"Allbridge Core Loses $1.65M to Flash Loan Again After Its Single-Pool Fix Missed Solana — TechTimes","type":"news_article","url":"https://www.techtimes.com/articles/321044/20260720/allbridge-core-loses-165m-flash-loan-again-after-its-single-pool-fix-missed-solana.htm"},{"credibility":2,"name":"Allbridge Core Updates Following the Relaunch — Allbridge Medium (2023 postmortem)","type":"official","url":"https://allbridge.medium.com/allbridge-core-updates-following-the-relaunch-9f7716eeb5da"},{"credibility":2,"name":"Allbridge Core Loses $1.65 Million to the Same Flash Loan Trick Twice — Startup Fortune","type":"news_article","url":"https://startupfortune.com/allbridge-core-loses-165-million-to-the-same-flash-loan-trick-twice/"}]},{"content":"Following the exploit, Allbridge Core's team immediately paused the protocol and publicly advised liquidity providers to withdraw from affected pools. The team stated that there was 'no threat to users' liquidity right now' while investigations were underway. In an unusual step, the team also publicly requested that traders who had profited from the temporary price imbalance created during the attack — an arbitrage opportunity available to other market participants during the manipulation window — voluntarily return those funds, stating that returned assets would 'go directly toward compensating affected LPs.' Allbridge subsequently announced a significant architectural shift: Core and Allbridge Classic would cease operating in their current pool-based form within three months, with the new version of Core planned to completely remove liquidity pools and instead route transfers through CCTP (Circle's Cross-Chain Transfer Protocol) and LayerZero, eliminating the pool imbalance attack surface entirely. This represented a fundamental departure from the protocol's original design.","heading":"Protocol Response and Relaunch Plan","severity":"high","sources":[{"credibility":2,"name":"Allbridge Pauses Cross-Chain Protocol After $1.65M Flash Loan Attack — Decrypt","type":"news_article","url":"https://decrypt.co/373831/allbridge-pauses-cross-chain-protocol-after-1-65m-flash-loan-attack"},{"credibility":2,"name":"Allbridge Core Pauses After $1.65M Flash-Loan Exploit — CryptoDaily","type":"news_article","url":"https://cryptodaily.co.uk/2026/07/allbridge-core-pauses-flash-loan-exploit"},{"credibility":2,"name":"Allbridge Core Loses $1.65M to Flash Loan Again — TechTimes","type":"news_article","url":"https://www.techtimes.com/articles/321044/20260720/allbridge-core-loses-165m-flash-loan-again-after-its-single-pool-fix-missed-solana.htm"}]},{"content":"The Allbridge Core July 2026 incident is consistent with a broader pattern of cross-chain bridge exploits in the DeFi ecosystem. Stablecoin AMM pools relying on invariant-based pricing mechanisms have historically been targeted by flash loan attacks due to the atomicity of such loans enabling rapid pool manipulation within a single transaction. The 2026 exploit exposed a systemic risk specific to multi-chain protocols: security patches applied to one blockchain deployment may not be uniformly propagated to all other deployments, creating inconsistent security postures across networks. The Allbridge case illustrates that a protocol's stated architectural commitments — such as the 2023 single-pool-per-chain policy — may not be verifiably enforced across all active deployments without explicit on-chain verification or cross-chain deployment audits. At the time of the 2026 incident, Allbridge Core was reported to have raised $2 million in 2022 specifically to fund security audits; the effectiveness and scope of those audits in covering all chain deployments was not detailed in public reporting.","heading":"Cross-Chain Bridge Security Context","severity":"high","sources":[{"credibility":2,"name":"Inside the Allbridge Flash-Loan Exploit on Solana — CryptoDaily","type":"news_article","url":"https://cryptodaily.co.uk/2026/07/allbridge-flash-loan-exploit-pool-manipulation"},{"credibility":2,"name":"Allbridge Core Hit by $1.65M Solana Flash-Loan Exploit, Its Second Since 2023 — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/20/allbridge-core-hit-by-1-65m-solana-flash-loan-exploit-its-second-since-2023/"},{"credibility":2,"name":"Allbridge Halts Core Bridge After $1.65M Flash Loan Exploit — The Defiant","type":"news_article","url":"https://thedefiant.io/news/hacks/allbridge-halts-core-bridge-after-1-65m-flash-loan-exploit"}]}],"sources_used":[{"credibility":1,"name":"Cross-chain protocol Allbridge halts after $1.65 million flash loan exploit — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/07/20/cross-chain-protocol-allbridge-halts-after-usd1-65-million-flash-loan-exploit"},{"credibility":1,"name":"Allbridge Core pauses protocol after $1.65 million flash loan exploit — The Block","type":"news_article","url":"https://www.theblock.co/post/408855/allbridge-core-exploit"},{"credibility":2,"name":"Allbridge Pauses Cross-Chain Protocol After $1.65M Flash Loan Attack — Decrypt","type":"news_article","url":"https://decrypt.co/373831/allbridge-pauses-cross-chain-protocol-after-1-65m-flash-loan-attack"},{"credibility":1,"name":"Allbridge Core Pauses Cross-Chain Bridge after $1.65M Exploit — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/allbridge-core-pauses-cross-chain-bridge-after-165m-exploit"},{"credibility":2,"name":"Allbridge Core Hit by $1.65M Solana Flash-Loan Exploit, Its Second Since 2023 — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/20/allbridge-core-hit-by-1-65m-solana-flash-loan-exploit-its-second-since-2023/"},{"credibility":2,"name":"Inside the Allbridge Flash-Loan Exploit on Solana — CryptoDaily","type":"news_article","url":"https://cryptodaily.co.uk/2026/07/allbridge-flash-loan-exploit-pool-manipulation"},{"credibility":2,"name":"Allbridge Core Pauses After $1.65M Flash-Loan Exploit — CryptoDaily","type":"news_article","url":"https://cryptodaily.co.uk/2026/07/allbridge-core-pauses-flash-loan-exploit"},{"credibility":2,"name":"Allbridge Core Loses $1.65M to Flash Loan Again After Its Single-Pool Fix Missed Solana — TechTimes","type":"news_article","url":"https://www.techtimes.com/articles/321044/20260720/allbridge-core-loses-165m-flash-loan-again-after-its-single-pool-fix-missed-solana.htm"},{"credibility":2,"name":"The Hack They Called 'Structurally Impossible' in 2023 Just Cost Them $1.65M — GlobalCryptoPress","type":"news_article","url":"https://www.globalcryptopress.com/2026/07/the-hack-they-called-structurally.html"},{"credibility":2,"name":"Allbridge Core Loses $1.65 Million to the Same Flash Loan Trick Twice — Startup Fortune","type":"news_article","url":"https://startupfortune.com/allbridge-core-loses-165-million-to-the-same-flash-loan-trick-twice/"},{"credibility":2,"name":"Allbridge Flash Loan Attack Drains $1.65M — For the Second Time — CryptoNomist","type":"news_article","url":"https://en.cryptonomist.ch/2026/07/20/allbridge-flash-loan-attack/"},{"credibility":2,"name":"Allbridge Core halted after $1.65M Solana exploit — crypto.news","type":"news_article","url":"https://crypto.news/allbridge-core-halted-after-1-65m-solana-exploit/"},{"credibility":2,"name":"Allbridge Core Pauses Protocol After Attacker Drains More Than $1 Million — BeInCrypto","type":"news_article","url":"https://beincrypto.com/allbridge-core-solana-exploit-paused/"},{"credibility":2,"name":"Allbridge Halts Core Bridge After $1.65M Flash Loan Exploit — The Defiant","type":"news_article","url":"https://thedefiant.io/news/hacks/allbridge-halts-core-bridge-after-1-65m-flash-loan-exploit"},{"credibility":2,"name":"Allbridge Core Updates Following the Relaunch — Allbridge Medium (2023 postmortem)","type":"official","url":"https://allbridge.medium.com/allbridge-core-updates-following-the-relaunch-9f7716eeb5da"},{"credibility":3,"name":"PeckShieldAlert on X — exploit flagged, funds bridged Solana to Ethereum","type":"social_media","url":"https://x.com/PeckShieldAlert/status/2079011150713561173"},{"credibility":3,"name":"Crypto Patel on X — attacker wallet addresses on Solana and Ethereum","type":"social_media","url":"https://x.com/CryptoPatel/status/2079106282083205557"},{"credibility":2,"name":"Allbridge Core Suffers Estimated $1.65M Solana Pool Exploit — CryptoRank","type":"news_article","url":"https://cryptorank.io/news/feed/605e8-allbridge-suspends-core-protocol-after-1-65m-solana-flash-loan-exploit"}],"summary":"On July 19–20, 2026, Allbridge Core's Solana deployment suffered a flash loan exploit that drained approximately $1.65 million from stablecoin liquidity pools. An attacker borrowed $1.12 million USDC from Kamino, manipulated pool pricing ratios, and withdrew assets at artificially favorable rates before bridging proceeds to Ethereum. The incident was the second flash loan attack on Allbridge Core, following a nearly identical April 2023 exploit on BNB Chain for which the team had published an architectural fix that was never applied to the Solana deployment.","timeline":[{"date":"2023-04-01","event":"Allbridge Core suffered a flash loan exploit on BNB Chain draining approximately $573,000 (approximately $289,900 BUSD and $290,900 USDT). Attacker manipulated swap prices by acting simultaneously as liquidity provider and swapper.","source":"CoinTelegraph / Allbridge Medium postmortem","source_url":"https://allbridge.medium.com/allbridge-core-updates-following-the-relaunch-9f7716eeb5da"},{"date":"2023-04-01","event":"Allbridge recovered approximately $465,000 of stolen funds through a white-hat arrangement with the attacker and compensated affected users who submitted recovery applications.","source":"Allbridge Medium postmortem","source_url":"https://allbridge.medium.com/allbridge-core-updates-following-the-relaunch-9f7716eeb5da"},{"date":"2023-05-30","event":"Allbridge published postmortem and relaunched Core with stated fix: single liquidity pool per blockchain, Rebalancer Authority, and automatic circuit-breaker mechanisms. The fix was applied to BNB Chain but the Solana deployment was not correspondingly updated.","source":"Allbridge Medium postmortem / TechTimes","source_url":"https://www.techtimes.com/articles/321044/20260720/allbridge-core-loses-165m-flash-loan-again-after-its-single-pool-fix-missed-solana.htm"},{"date":"2026-07-19","event":"Attacker borrowed approximately $1.12 million USDC from Kamino on Solana, executed rapid USDC/USDT swaps to distort Allbridge Core's Solana pool ratios, withdrew approximately $1.65 million at manipulated rates, and repaid the flash loan within the same transaction.","source":"CoinDesk / Decrypt / CryptoTimes","source_url":"https://www.coindesk.com/business/2026/07/20/cross-chain-protocol-allbridge-halts-after-usd1-65-million-flash-loan-exploit"},{"date":"2026-07-19","event":"Stolen funds bridged from Solana (attacker address: FhffBraZsGn4H2LxLNToEcaHWEfWwT2UcSz4oRHb7Qdc) to Ethereum (address: 0x651591b68A9c9650FB23F642162353306281ffDe) and dispersed across additional addresses, with partial routing through privacy pools.","source":"PeckShieldAlert on X / Crypto Patel on X","source_url":"https://x.com/PeckShieldAlert/status/2079011150713561173"},{"date":"2026-07-20","event":"Allbridge Core paused the protocol and published a public statement advising liquidity providers to withdraw and requesting voluntary return of arbitrage profits from traders who benefited from the manipulation window.","source":"CoinDesk / Decrypt / CoinTelegraph","source_url":"https://cointelegraph.com/news/allbridge-core-pauses-cross-chain-bridge-after-165m-exploit"},{"date":"2026-07-20","event":"Allbridge announced a structural redesign of Core: liquidity pools to be removed within three months, with routing switched to CCTP and LayerZero to eliminate the pool-based attack surface.","source":"TechTimes / Decrypt","source_url":"https://decrypt.co/373831/allbridge-pauses-cross-chain-protocol-after-1-65m-flash-loan-attack"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 3158106e-6d75-420d-95ce-b231d245297dcopy