{"investigation":{"slug":"allbridge-core-second-flash-loan-exploit-july-2026","entity_name":"Allbridge Core Second Flash-Loan Exploit (July 2026)","trust_score":0,"severity_base":null,"score_modifier":-12.6,"confidence":0.82,"status":"published","content_type":"investigation","summary":"On July 19–20, 2026, Allbridge Core, a cross-chain stablecoin bridge, lost an estimated $1.65–1.66 million in a flash-loan exploit on its Solana USDC/USDT liquidity pools. The attacker borrowed $1.12 million USDC from Kamino Finance, distorted the pools' internal stablecoin ratio with rapid swaps, withdrew liquidity at the manipulated rates, and bridged the proceeds to Ethereum. It was the second structurally similar attack on the protocol since April 2023, and reporting found that the 'single pool per blockchain' fix Allbridge promised after the first exploit had never been applied to its Solana deployment.","sections":[{"content":"On July 19, 2026, at about 17:51 UTC, Allbridge Core's Solana stablecoin liquidity pools were drained in a flash-loan exploit. Reports differ on the size of the loss. PeckShield estimated about $1.65 million, a figure repeated by most outlets and corroborated by CertiK. NFTEvening and Daily Hodl reported about $1.66 million. On-chain analytics service Onchain Lens reported a narrower confirmed on-chain figure of just over $1.1 million at the time of first reporting. One account attributes the gap to methodology: PeckShield's estimate includes indirect losses from pool imbalance and liquidity distortion, while Onchain Lens counted only directly attributable token outflows. The difference has not been formally reconciled in public reporting. Allbridge Core is a cross-chain bridge that routes native stablecoins (USDC, USDT) between blockchains without issuing wrapped assets. At the time of the exploit it served about 890,000 wallets and held a TVL of about $21.61 million. After the exploit, TVL fell by more than 40 percent, to about $12.78 million, as liquidity providers withdrew.","heading":"Incident Overview","sources":[{"url":"https://www.theblock.co/post/408855/allbridge-core-exploit","name":"Allbridge Core pauses protocol after $1.65 million flash loan exploit — The Block","type":"news_article","credibility":1},{"url":"https://www.coindesk.com/business/2026/07/20/cross-chain-protocol-allbridge-halts-after-usd1-65-million-flash-loan-exploit","name":"Cross-chain protocol Allbridge halts after $1.65 million flash loan exploit — CoinDesk","type":"news_article","credibility":1},{"url":"https://nftevening.com/allbridge-core-pauses-bridge-after-1-66m-solana-flash-loan-exploit/","name":"Allbridge Core Pauses Bridge After $1.66M Solana Flash Loan Exploit — NFTEvening","type":"news_article","credibility":2},{"url":"https://en.cryptonomist.ch/2026/07/20/allbridge-flash-loan-attack/","name":"Allbridge Flash Loan Attack Drains $1.65M — For the Second Time — Cryptonomist","type":"news_article","credibility":2},{"url":"https://ambcrypto.com/allbridge-exploit-flash-loans-still-haunt-defi-1-65m-drained-via-usdc-usdt-pool/","name":"Allbridge exploit: Flash loans still haunt DeFi — AMBCrypto","type":"news_article","credibility":2},{"url":"https://cryptodaily.co.uk/2026/07/allbridge-core-pauses-flash-loan-exploit","name":"Allbridge Core Pauses After $1.65M Flash-Loan Exploit — CryptoDaily","type":"news_article","credibility":2},{"url":"https://dailyhodl.com/2026/07/21/hacker-exploits-allbridge-core-draining-1660000-worth-of-crypto-from-cross-chain-stablecoin-bridge/","name":"Hacker Exploits Allbridge Core, Draining $1,660,000 — Daily Hodl","type":"news_article","credibility":2},{"url":"https://x.com/PeckShieldAlert/status/2079011150713561173","name":"PeckShieldAlert on X — exploit flagged, funds bridged Solana to Ethereum","type":"social_media","credibility":3}],"severity":"critical"},{"content":"The exploit targeted Allbridge Core's native-liquidity model on Solana, which prices liquidity withdrawals from the internal ratio of USDC to USDT held in its own pools. That design is exposed to manipulation of the ratio within a single transaction. The pools rely on curve-based invariants meant to keep stablecoins near 1:1 parity with low slippage. The attacker took a flash loan of about $1.12 million USDC from Kamino Finance, a Solana lending protocol. Kamino itself was not compromised; it served as the capital source in its intended role. The attacker then made repeated, alternating USDC-to-USDT swaps in the Allbridge pool, pushing the internal ratio away from parity in a nine-step manipulation sequence, and withdrew liquidity at the distorted, favorable rates. The flash loan was repaid within the same atomic transaction and the attacker kept the difference. On-chain data shows a recorded net withdrawal of 948,927.53 USDT from the affected pools. The single largest related withdrawal reportedly reached $2.24 million in gross USDC before loan repayment, described in one account as an exchange of a few thousand dollars of USDT for about $2.24 million USDC. Post-exploit analysis identified three defense failures: dynamic fees stayed static instead of scaling with the speed of manipulation, TWAP (time-weighted average price) guards were absent, and circuit breakers did not trigger despite a ratio deviation beyond normal thresholds. The nine-step sequence moved faster than the Rebalancer Authority could react.","heading":"Attack Mechanics","sources":[{"url":"https://cryptodaily.co.uk/2026/07/allbridge-flash-loan-exploit-pool-manipulation","name":"Allbridge Flash-Loan Exploit: How Pool Manipulation Drained $1.65 Million — CryptoDaily","type":"news_article","credibility":2},{"url":"https://nftevening.com/allbridge-core-pauses-bridge-after-1-66m-solana-flash-loan-exploit/","name":"Allbridge Core Pauses Bridge After $1.66M Solana Flash Loan Exploit — NFTEvening","type":"news_article","credibility":2},{"url":"https://ambcrypto.com/allbridge-exploit-flash-loans-still-haunt-defi-1-65m-drained-via-usdc-usdt-pool/","name":"Allbridge exploit: Flash loans still haunt DeFi — AMBCrypto","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/07/20/allbridge-core-hit-by-1-65m-solana-flash-loan-exploit-its-second-since-2023/","name":"Allbridge Core Hit by $1.65M Solana Flash-Loan Exploit, Its Second Since 2023 — CryptoTimes","type":"news_article","credibility":2},{"url":"https://startupfortune.com/allbridge-core-loses-165-million-to-the-same-flash-loan-trick-twice/","name":"Allbridge Core Loses $1.65 Million to the Same Flash Loan Trick Twice — Startup Fortune","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/408855/allbridge-core-exploit","name":"Allbridge Core pauses protocol after $1.65 million flash loan exploit — The Block","type":"news_article","credibility":1},{"url":"https://decrypt.co/373831/allbridge-pauses-cross-chain-protocol-after-1-65m-flash-loan-attack","name":"Allbridge Pauses Cross-Chain Protocol After $1.65M Flash Loan Attack — Decrypt","type":"news_article","credibility":1}],"severity":"critical"},{"content":"On-chain analysts, including CertiKAlert and Crypto Patel, publicly identified two attacker addresses: the Solana wallet FhffBraZsGn4H2LxLNToEcaHWEfWwT2UcSz4oRHb7Qdc and the Ethereum consolidation address 0x651591b68A9c9650FB23F642162353306281ffDe. PeckShield's on-chain analysis also identified the Ethereum address. Within hours of the exploit, the stolen assets were bridged from Solana to the Ethereum address, converted to ETH, and spread across several more Ethereum addresses. Part of the funds were then routed through privacy protocols, including Railgun, NEAR Intents and Zcash Orchard, to hide the trail. This was reported by PeckShield, CertiK, The Defiant and CryptoTimes. On-chain analyst Hupzy described the cross-chain movement as a common laundering tactic that can make recovery much harder. Allbridge and its forensic partners traced about $1.63 million of the stolen funds. Reports differ on what was taken: one account gives 1,118,239 USDC plus 538,692 USDT, while on-chain reporting records a net withdrawal of 948,927.53 USDT (see Attack Mechanics). The final destination of all the funds was not confirmed at the time of reporting, and no funds had been publicly confirmed as returned.","heading":"Fund Movements and Attacker Addresses","sources":[{"url":"https://x.com/CryptoPatel/status/2079106282083205557","name":"Crypto Patel on X — attacker wallet addresses identified","type":"social_media","credibility":3},{"url":"https://x.com/CertiKAlert/status/2079013163014770987","name":"CertiK Alert on X","type":"social_media","credibility":3},{"url":"https://x.com/PeckShieldAlert/status/2079011150713561173","name":"PeckShieldAlert on X — exploit flagged, funds bridged Solana to Ethereum","type":"social_media","credibility":3},{"url":"https://coinpedia.org/news/allbridge-core-hit-by-1-65m-solana-exploit-funds-traced-to-ethereum/","name":"Allbridge Core Hit by $1.65M Solana Exploit, Funds Traced to Ethereum — Coinpedia","type":"news_article","credibility":2},{"url":"https://nftevening.com/allbridge-core-pauses-bridge-after-1-66m-solana-flash-loan-exploit/","name":"Allbridge Core Pauses Bridge After $1.66M Solana Flash Loan Exploit — NFTEvening","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/07/20/allbridge-core-hit-by-1-65m-solana-flash-loan-exploit-its-second-since-2023/","name":"Allbridge Core Hit by $1.65M Solana Flash-Loan Exploit, Its Second Since 2023 — CryptoTimes","type":"news_article","credibility":2},{"url":"https://thedefiant.io/news/hacks/allbridge-halts-core-bridge-after-1-65m-flash-loan-exploit","name":"Allbridge Halts Core Bridge After $1.65M Flash Loan Exploit — The Defiant","type":"news_article","credibility":2},{"url":"https://www.tradingview.com/news/coinpedia:19f5bacbd094b:0-allbridge-core-hit-by-1-65m-solana-exploit-funds-traced-to-ethereum/","name":"Allbridge Core Hit by $1.65M Solana Exploit, Funds Traced to Ethereum — TradingView/Coinpedia","type":"on_chain","credibility":2},{"url":"https://beincrypto.com/allbridge-core-solana-exploit-paused/","name":"Allbridge Core Pauses Protocol After Attacker Drains More Than $1 Million — BeInCrypto","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Allbridge Core's first flash-loan exploit hit its BNB Chain stablecoin pools on about April 1–2, 2023, draining about $570,000–$573,000: roughly $289,900 in BUSD and $290,900 in USDT. The attacker acted as both liquidity provider and swapper to manipulate swap pricing. Sources describe the flaw slightly differently: as a logic flaw in the withdraw function's swap-price calculation, or as a manipulation of Allbridge's vUSD minting logic. Allbridge offered the attacker a 10 percent white-hat bounty, and the attacker returned about 1,500 BNB (about $465,000 at the time), which was used to compensate affected users. In a postmortem on its official Medium account, dated May 30, 2023 in one report, Allbridge relaunched Core with several remediations: corrected liquidity calculations, withdrawal caps tied to LP token balances, automatic pool suspension when imbalances hit set thresholds, stronger manual emergency controls, and a 'Rebalancer Authority', a special administrative account that can rebalance pools across chains without paying fees. The team also committed to open-sourcing its EVM and Tron contract repositories. The postmortem named the main structural defense against flash loans as deploying only a single liquidity pool per blockchain, which it said would make same-transaction flash-loan manipulation 'structurally impossible'; as reported, 'one pool means no sibling pool to swap against, no ratio to distort, and no path for a flash loan to do anything useful.' According to TechTimes, CryptoTimes, Startup Fortune and GlobalCryptoPress, the fix was applied to the BNB Chain deployment, but the Solana program was never updated and kept running USDC and USDT pools side by side, the exact configuration the single-pool policy was meant to retire. TechTimes' headline read: 'Allbridge Core Loses $1.65M to Flash Loan Again After Its Single-Pool Fix Missed Solana.' One analysis concluded that 'a security commitment that existed in a blog post did not exist in the code on at least one chain, and there was apparently no process catching the gap.' Possible explanations are that the commitment was not applied uniformly, that Solana was left out of scope deliberately or by mistake, or that the architecture was later reversed on Solana. Allbridge has not publicly explained the discrepancy.","heading":"Prior 2023 Exploit and Incomplete Remediation","sources":[{"url":"https://www.techtimes.com/articles/321044/20260720/allbridge-core-loses-165m-flash-loan-again-after-its-single-pool-fix-missed-solana.htm","name":"Allbridge Core Loses $1.65M to Flash Loan Again After Its Single-Pool Fix Missed Solana — TechTimes","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/07/20/allbridge-core-hit-by-1-65m-solana-flash-loan-exploit-its-second-since-2023/","name":"Allbridge Core Hit by $1.65M Solana Flash-Loan Exploit, Its Second Since 2023 — CryptoTimes","type":"news_article","credibility":2},{"url":"https://medium.com/coinmonks/decoding-allbridge-570k-flash-loan-exploit-quillaudits-8da8dccd729d","name":"Decoding AllBridge $570K Flash Loan Exploit — QuillAudits / Coinmonks","type":"research","credibility":2},{"url":"https://allbridge.medium.com/allbridge-core-updates-following-the-relaunch-9f7716eeb5da","name":"Allbridge Core Updates Following the Relaunch — Allbridge Medium","type":"official","credibility":2},{"url":"https://startupfortune.com/allbridge-core-loses-165-million-to-the-same-flash-loan-trick-twice/","name":"Allbridge Core Loses $1.65 Million to the Same Flash Loan Trick Twice — Startup Fortune","type":"news_article","credibility":2},{"url":"https://www.globalcryptopress.com/2026/07/the-hack-they-called-structurally.html","name":"The Hack They Called 'Structurally Impossible' in 2023 Just Cost Them $1.65M — GlobalCryptoPress","type":"news_article","credibility":2},{"url":"https://en.cryptonomist.ch/2026/07/20/allbridge-flash-loan-attack/","name":"Allbridge Flash Loan Attack Drains $1.65M — For the Second Time — Cryptonomist","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Allbridge underwent at least five security audits before the July 2026 exploit: Hacken (September 2021), Hacken again (February 2022), Kudelski Security (May 2022), Cossack Labs (September 2022) and CoinFabrik (July 2023, after the first exploit). Halborn also assessed Allbridge's Bridge and ERC20 contracts between June 17 and July 17, 2024. Allbridge Core reportedly raised $2 million in 2022 specifically to fund security audits; public reporting does not say how well those audits covered every chain deployment. Frequent auditing did not prevent a repeat exploit through a structurally similar vector. Allbridge's post-2023 Medium post said Solana contract verification would be added to the public GitHub repository pending 'internal tests', which suggests the Solana deployment may have received less scrutiny than other chains when the single-pool fix went in. PeckShield and CertiK independently confirmed the exploit and its mechanism shortly after it happened, and Onchain Lens gave transaction-level detail via Solscan. As of the reporting window, neither Allbridge nor an independent security firm had published a full technical postmortem explaining why the Rebalancer Authority and other 2023-era protections failed.","heading":"Security Audit History and Post-Exploit Analysis","sources":[{"url":"https://www.coinfabrik.com/blog/allbridge-audit-report/","name":"AllBridge Audit Report — CoinFabrik","type":"research","credibility":2},{"url":"https://www.halborn.com/audits/casper-association/casper---allbridge-fa8c33","name":"Bridge Contracts Audit — Halborn","type":"research","credibility":2},{"url":"https://www.cossacklabs.com/case-studies/smart-contract-security-audit-for-allbridge-cross-chain-bridge-with-tezos/","name":"Smart contract security audit for Allbridge Classic — Cossack Labs","type":"research","credibility":2},{"url":"https://allbridge.medium.com/allbridge-core-updates-following-the-relaunch-9f7716eeb5da","name":"Allbridge Core Updates Following the Relaunch — Allbridge Medium","type":"official","credibility":2},{"url":"https://www.theblock.co/post/408855/allbridge-core-exploit","name":"Allbridge Core pauses protocol after $1.65 million flash loan exploit — The Block","type":"news_article","credibility":1},{"url":"https://www.cryptotimes.io/2026/07/20/allbridge-core-hit-by-1-65m-solana-flash-loan-exploit-its-second-since-2023/","name":"Allbridge Core Hit by $1.65M Solana Flash-Loan Exploit, Its Second Since 2023 — CryptoTimes","type":"news_article","credibility":2},{"url":"https://blockzeit.com/allbridge-core-exploit-losses-estimated-at-around-1-65m/","name":"Allbridge Confirms Core Exploit, Losses Estimated Around $1.65M — Blockzeit","type":"news_article","credibility":2},{"url":"https://cryptodaily.co.uk/2026/07/allbridge-core-pauses-flash-loan-exploit","name":"Allbridge Core Pauses After $1.65M Flash-Loan Exploit — CryptoDaily","type":"news_article","credibility":2}],"severity":"high"},{"content":"Allbridge paused its Core protocol after the exploit, within about 25 minutes of detection according to one account. Reports differ on the date of the pause: it is placed on July 19, 2026 in one account and on July 20, 2026 in another (see Timeline). The team's public statement read: 'Allbridge Core is experiencing a security incident, and the protocol has been paused as a precaution.' One report quotes the fuller text as 'Allbridge Core is experiencing a security incident. We have paused the protocol as a precaution while we investigate. If you have liquidity in affected pools, please withdraw now.' The team also said there was 'no threat to users' liquidity right now' while the investigation continued. It urged liquidity providers to withdraw from affected pools. In an unusual step, it asked traders who had profited from the temporary price imbalance (a group separate from the main attacker) to voluntarily return those gains to a designated recovery address, saying returned assets would 'go directly toward compensating affected LPs.' This mirrors the voluntary-return approach Allbridge used after the 2023 exploit. No recovery of funds was announced during the reporting window, and the protocol made no binding compensation commitment or timeline. Allbridge then announced a major architectural change: Allbridge Core and Allbridge Classic would stop operating in their current pool-based form within three months. The new version of Core is planned to remove liquidity pools entirely and route transfers through CCTP (Circle's Cross-Chain Transfer Protocol) and LayerZero, eliminating the pool-imbalance attack surface.","heading":"Protocol Response and Recovery Efforts","sources":[{"url":"https://beincrypto.com/allbridge-core-solana-exploit-paused/","name":"Allbridge Core Pauses Protocol After Attacker Drains More Than $1 Million — BeInCrypto","type":"news_article","credibility":2},{"url":"https://nftevening.com/allbridge-core-pauses-bridge-after-1-66m-solana-flash-loan-exploit/","name":"Allbridge Core Pauses Bridge After $1.66M Solana Flash Loan Exploit — NFTEvening","type":"news_article","credibility":2},{"url":"https://www.cryptometer.io/news/allbridge-core-pauses-protocol-after-1-65-million-exploit-as-investigation-begins/","name":"Allbridge Core Pauses Protocol After $1.65 Million Exploit as Investigation Begins — Cryptometer","type":"news_article","credibility":2},{"url":"https://coinpedia.org/news/allbridge-core-hit-by-1-65m-solana-exploit-funds-traced-to-ethereum/","name":"Allbridge Core Hit by $1.65M Solana Exploit, Funds Traced to Ethereum — Coinpedia","type":"news_article","credibility":2},{"url":"https://www.coindesk.com/business/2026/07/20/cross-chain-protocol-allbridge-halts-after-usd1-65-million-flash-loan-exploit","name":"Cross-chain protocol Allbridge halts after $1.65 million flash loan exploit — CoinDesk","type":"news_article","credibility":1},{"url":"https://cryptodaily.co.uk/2026/07/allbridge-core-pauses-flash-loan-exploit","name":"Allbridge Core Pauses After $1.65M Flash-Loan Exploit — CryptoDaily","type":"news_article","credibility":2},{"url":"https://finance.yahoo.com/markets/crypto/articles/allbridge-core-pauses-protocol-attacker-023505603.html","name":"Allbridge Core Pauses Protocol After Attacker Drains More Than $1 Million — Yahoo Finance","type":"news_article","credibility":2},{"url":"https://decrypt.co/373831/allbridge-pauses-cross-chain-protocol-after-1-65m-flash-loan-attack","name":"Allbridge Pauses Cross-Chain Protocol After $1.65M Flash Loan Attack — Decrypt","type":"news_article","credibility":1},{"url":"https://www.techtimes.com/articles/321044/20260720/allbridge-core-loses-165m-flash-loan-again-after-its-single-pool-fix-missed-solana.htm","name":"Allbridge Core Loses $1.65M to Flash Loan Again After Its Single-Pool Fix Missed Solana — TechTimes","type":"news_article","credibility":2},{"url":"https://allbridge.medium.com/allbridge-core-updates-following-the-relaunch-9f7716eeb5da","name":"Allbridge Core Updates Following the Relaunch — Allbridge Medium","type":"official","credibility":2}],"severity":"high"},{"content":"The exploit came during a period of frequent attacks on cross-chain bridges. CoinTelegraph described the Allbridge incident as 'at least the sixth attack targeting a cross-chain bridge since May' 2026. According to NullTX, about $210.3 million was lost across 30 major crypto hacks in July 2026, up 177.2% from $75.87 million the month before. Other July 2026 bridge incidents included the Wanchain and Verus bridge vulnerabilities (a combined $20.5 million) and a Transit Finance exploit ($1.88 million). Commentators stressed that few of July's losses came from genuinely new attack vectors. Most exploited known, unaddressed vulnerability classes, such as single-source price feeds, inadequate circuit breakers and pool pricing susceptible to flash loans; this is the same class Allbridge had said it remediated in 2023. Stablecoin AMM pools that rely on invariant-based pricing have long been targets for flash-loan attacks, because the atomic loan allows rapid pool manipulation within one transaction. The Allbridge case also shows a risk specific to multi-chain protocols: a security patch applied on one chain may not reach every other deployment, and stated architectural commitments may go unenforced without on-chain verification or audits across deployments.","heading":"Broader Industry Context: Cross-Chain Bridge Vulnerabilities in 2026","sources":[{"url":"https://cointelegraph.com/news/allbridge-core-pauses-cross-chain-bridge-after-165m-exploit","name":"Allbridge Core pauses cross-chain bridge after $1.65M exploit — CoinTelegraph","type":"news_article","credibility":1},{"url":"https://nulltx.com/how-julys-210m-in-hacks-could-have-been-prevented","name":"How July's $210M In Hacks Could Have Been Prevented — NullTX","type":"news_article","credibility":2},{"url":"https://www.tronweekly.com/allbridge-core-exploit-forces-bridge-pause/","name":"Allbridge Core Exploit Pauses Cross-Chain Bridge After $1.65M Solana Attack — TronWeekly","type":"news_article","credibility":2},{"url":"https://cryptodaily.co.uk/2026/07/allbridge-flash-loan-exploit-pool-manipulation","name":"Allbridge Flash-Loan Exploit: How Pool Manipulation Drained $1.65 Million — CryptoDaily","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/07/20/allbridge-core-hit-by-1-65m-solana-flash-loan-exploit-its-second-since-2023/","name":"Allbridge Core Hit by $1.65M Solana Flash-Loan Exploit, Its Second Since 2023 — CryptoTimes","type":"news_article","credibility":2},{"url":"https://thedefiant.io/news/hacks/allbridge-halts-core-bridge-after-1-65m-flash-loan-exploit","name":"Allbridge Halts Core Bridge After $1.65M Flash Loan Exploit — The Defiant","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Several documented risk factors follow from the July 2026 exploit. First, it repeats the April 2023 attack: the same flash-loan pool-manipulation vector was used against the same protocol. Second, the post-2023 remediation was incomplete: the single-pool fix the team publicly committed to was not applied to the Solana deployment, and the gap was not caught by the audits that followed the 2023 incident, including CoinFabrik's in July 2023 and Halborn's in mid-2024. Third, the Rebalancer Authority introduced after 2023 could not keep up with the nine-step manipulation sequence. Fourth, moving the proceeds through privacy protocols (Railgun, NEAR Intents, Zcash Orchard) makes recovery less likely. Allbridge's announced exit from pool-based bridging is a substantive architectural response, but it also means Allbridge Core in its current form is being wound down. Users with liquidity positions in Allbridge Core should note the ongoing suspension and the announced three-month transition. As of the investigation date, no regulatory filing, law enforcement action or civil litigation related to the incident had been identified.","heading":"Risk Assessment","sources":[{"url":"https://www.techtimes.com/articles/321044/20260720/allbridge-core-loses-165m-flash-loan-again-after-its-single-pool-fix-missed-solana.htm","name":"Allbridge Core Loses $1.65M to Flash Loan Again After Its Single-Pool Fix Missed Solana — TechTimes","type":"news_article","credibility":2},{"url":"https://cryptodaily.co.uk/2026/07/allbridge-core-pauses-flash-loan-exploit","name":"Allbridge Core Pauses After $1.65M Flash-Loan Exploit — CryptoDaily","type":"news_article","credibility":2},{"url":"https://decrypt.co/373831/allbridge-pauses-cross-chain-protocol-after-1-65m-flash-loan-attack","name":"Allbridge Pauses Cross-Chain Protocol After $1.65M Flash Loan Attack — Decrypt","type":"news_article","credibility":1},{"url":"https://en.cryptonomist.ch/2026/07/20/allbridge-flash-loan-attack/","name":"Allbridge Flash Loan Attack Drains $1.65M — For the Second Time — Cryptonomist","type":"news_article","credibility":2},{"url":"https://allbridge.medium.com/allbridge-core-updates-following-the-relaunch-9f7716eeb5da","name":"Allbridge Core Updates Following the Relaunch — Allbridge Medium","type":"official","credibility":2}],"severity":"high"}],"timeline":[{"date":"2023-04","event":"Allbridge Core suffers its first flash-loan exploit on BNB Chain, losing about $573,000 in BUSD and USDT (about $289,900 BUSD and $290,900 USDT). The attacker acted as both liquidity provider and swapper to manipulate pool pricing.","source":"QuillAudits / Coinmonks; CryptoTimes; Allbridge Medium","source_url":"https://medium.com/coinmonks/decoding-allbridge-570k-flash-loan-exploit-quillaudits-8da8dccd729d"},{"date":"2023-04","event":"Allbridge contacts the attacker on-chain, offering a 10 percent white-hat bounty in exchange for the return of the stolen funds.","source":"Allbridge Medium / CryptoTimes","source_url":"https://allbridge.medium.com/allbridge-core-updates-following-the-relaunch-9f7716eeb5da"},{"date":"2023-04","event":"The attacker returns about 1,500 BNB (about $465,000) to Allbridge, which uses the recovered funds to compensate affected liquidity providers.","source":"Allbridge Medium postmortem / The Block","source_url":"https://allbridge.medium.com/allbridge-core-updates-following-the-relaunch-9f7716eeb5da"},{"date":"2023-05","event":"Allbridge publishes its postmortem and relaunches Core, committing to a single liquidity pool per blockchain, a Rebalancer Authority, automatic circuit breakers and withdrawal caps. The fix was applied on BNB Chain, but the Solana deployment was not updated.","source":"Allbridge Medium postmortem / TechTimes","source_url":"https://www.techtimes.com/articles/321044/20260720/allbridge-core-loses-165m-flash-loan-again-after-its-single-pool-fix-missed-solana.htm"},{"date":"2023-07","event":"CoinFabrik completes a security audit of Allbridge.","source":"AllBridge Audit Report — CoinFabrik","source_url":"https://www.coinfabrik.com/blog/allbridge-audit-report/"},{"date":"2024-07","event":"Halborn completes its security assessment of Allbridge's Bridge and ERC20 contracts (the engagement ran from June 17 to July 17, 2024).","source":"Bridge Contracts Audit — Halborn","source_url":"https://www.halborn.com/audits/casper-association/casper---allbridge-fa8c33"},{"date":"2026-07","event":"At about 17:51 UTC, an attacker takes a $1.12 million USDC flash loan from Kamino Finance on Solana and runs a nine-step manipulation of Allbridge Core's USDC/USDT pool, draining about $1.65–1.66 million and repaying the loan in the same transaction.","source":"NFTEvening; The Block; CoinDesk","source_url":"https://nftevening.com/allbridge-core-pauses-bridge-after-1-66m-solana-flash-loan-exploit/"},{"date":"2026-07","event":"Within hours, the stolen funds are bridged from Solana wallet FhffBraZsGn4H2LxLNToEcaHWEfWwT2UcSz4oRHb7Qdc to Ethereum address 0x651591b68A9c9650FB23F642162353306281ffDe, converted to ETH, spread across more addresses, and partly routed through Railgun, NEAR Intents and Zcash Orchard.","source":"Crypto Patel on X; PeckShieldAlert on X; The Defiant","source_url":"https://x.com/CryptoPatel/status/2079106282083205557"},{"date":"2026-07","event":"Allbridge Core is paused within about 25 minutes of the exploit, according to one account; other reports place the pause on July 20.","source":"Crypto Patel on X; The Block","source_url":"https://www.theblock.co/post/408855/allbridge-core-exploit"},{"date":"2026-07","event":"Allbridge issues a public statement confirming the security incident, urging LPs to withdraw, and asking arbitrageurs to voluntarily return their profits.","source":"CoinDesk; CoinTelegraph; Yahoo Finance","source_url":"https://www.coindesk.com/business/2026/07/20/cross-chain-protocol-allbridge-halts-after-usd1-65-million-flash-loan-exploit"},{"date":"2026-07","event":"Allbridge announces that Core and Allbridge Classic will stop pool-based operations within three months, moving to CCTP and LayerZero routing.","source":"Decrypt; TechTimes; CoinDesk","source_url":"https://decrypt.co/373831/allbridge-pauses-cross-chain-protocol-after-1-65m-flash-loan-attack"},{"date":"2026-07","event":"PeckShield and CertiK independently confirm the exploit. Allbridge reports tracing about $1.63 million of the stolen funds, with no recovery confirmed. Allbridge Core's TVL falls from about $21.61 million to $12.78 million.","source":"Coinpedia; AMBCrypto; Blockzeit","source_url":"https://coinpedia.org/news/allbridge-core-hit-by-1-65m-solana-exploit-funds-traced-to-ethereum/"}],"sources_used":[{"url":"https://www.coindesk.com/business/2026/07/20/cross-chain-protocol-allbridge-halts-after-usd1-65-million-flash-loan-exploit","name":"Cross-chain protocol Allbridge halts after $1.65 million flash loan exploit — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260721114317/https://www.coindesk.com/business/2026/07/20/cross-chain-protocol-allbridge-halts-after-usd1-65-million-flash-loan-exploit","credibility":1,"archive_timestamp":"2026-07-21T11:43:17+00:00"},{"url":"https://www.theblock.co/post/408855/allbridge-core-exploit","name":"Allbridge Core pauses protocol after $1.65 million flash loan exploit — The Block","type":"news_article","archive_url":"http://web.archive.org/web/20260720175023/https://www.theblock.co/post/408855/allbridge-core-exploit","credibility":1,"archive_timestamp":"2026-07-20T17:50:23+00:00"},{"url":"https://cointelegraph.com/news/allbridge-core-pauses-cross-chain-bridge-after-165m-exploit","name":"Allbridge pauses cross-chain bridge after $1.65M exploit — CoinTelegraph","type":"news_article","archive_url":"http://web.archive.org/web/20260724033857/https://cointelegraph.com/news/allbridge-core-pauses-cross-chain-bridge-after-165m-exploit","credibility":1,"archive_timestamp":"2026-07-24T03:38:57+00:00"},{"url":"https://decrypt.co/373831/allbridge-pauses-cross-chain-protocol-after-1-65m-flash-loan-attack","name":"Allbridge Pauses Cross-Chain Protocol After $1.65M Flash Loan Attack — Decrypt","type":"news_article","archive_url":"http://web.archive.org/web/20260802212341/https://decrypt.co/373831/allbridge-pauses-cross-chain-protocol-after-1-65m-flash-loan-attack","credibility":1,"archive_timestamp":"2026-08-02T21:23:41+00:00"},{"url":"https://en.cryptonomist.ch/2026/07/20/allbridge-flash-loan-attack/","name":"Allbridge Flash Loan Attack Drains $1.65M — For the Second Time — Cryptonomist","type":"news_article","archive_url":"http://web.archive.org/web/20260803000242/https://en.cryptonomist.ch/2026/07/20/allbridge-flash-loan-attack/","credibility":2,"archive_timestamp":"2026-08-03T00:02:42+00:00"},{"url":"https://www.techtimes.com/articles/321044/20260720/allbridge-core-loses-165m-flash-loan-again-after-its-single-pool-fix-missed-solana.htm","name":"Allbridge Core Loses $1.65M to Flash Loan Again After Its Single-Pool Fix Missed Solana — TechTimes","type":"news_article","archive_url":"http://web.archive.org/web/20260722024034/https://www.techtimes.com/articles/321044/20260720/allbridge-core-loses-165m-flash-loan-again-after-its-single-pool-fix-missed-solana.htm","credibility":2,"archive_timestamp":"2026-07-22T02:40:34+00:00"},{"url":"https://www.cryptotimes.io/2026/07/20/allbridge-core-hit-by-1-65m-solana-flash-loan-exploit-its-second-since-2023/","name":"Allbridge Core Hit by $1.65M Solana Flash-Loan Exploit, Its Second Since 2023 — CryptoTimes","type":"news_article","archive_url":"http://web.archive.org/web/20260728184107/https://www.cryptotimes.io/2026/07/20/allbridge-core-hit-by-1-65m-solana-flash-loan-exploit-its-second-since-2023/","credibility":2,"archive_timestamp":"2026-07-28T18:41:07+00:00"},{"url":"https://coinpedia.org/news/allbridge-core-hit-by-1-65m-solana-exploit-funds-traced-to-ethereum/","name":"Allbridge Core Hit by $1.65M Solana Exploit, Funds Traced to Ethereum — Coinpedia","type":"news_article","archive_url":"http://web.archive.org/web/20260720071459/https://coinpedia.org/news/allbridge-core-hit-by-1-65m-solana-exploit-funds-traced-to-ethereum/","credibility":2,"archive_timestamp":"2026-07-20T07:14:59+00:00"},{"url":"https://crypto.news/allbridge-core-halted-after-1-65m-solana-exploit/","name":"Allbridge Core halted after $1.65M Solana exploit — Crypto.news","type":"news_article","archive_url":"https://web.archive.org/web/20260802235936/https://crypto.news/allbridge-core-halted-after-1-65m-solana-exploit/","credibility":2,"archive_timestamp":"2026-08-02T23:59:36+00:00"},{"url":"https://cryptodaily.co.uk/2026/07/allbridge-core-pauses-flash-loan-exploit","name":"Allbridge Core Pauses After $1.65M Flash-Loan Exploit — CryptoDaily","type":"news_article","archive_url":"https://web.archive.org/web/20260803022219/https://cryptodaily.co.uk/2026/07/allbridge-core-pauses-flash-loan-exploit","credibility":2,"archive_timestamp":"2026-08-03T02:22:19+00:00"},{"url":"https://cryptodaily.co.uk/2026/07/allbridge-flash-loan-exploit-pool-manipulation","name":"Allbridge Flash-Loan Exploit: How Pool Manipulation Drained $1.65 Million — CryptoDaily","type":"news_article","archive_url":"http://web.archive.org/web/20260727094710/https://cryptodaily.co.uk/2026/07/allbridge-flash-loan-exploit-pool-manipulation","credibility":2,"archive_timestamp":"2026-07-27T09:47:10+00:00"},{"url":"https://nftevening.com/allbridge-core-pauses-bridge-after-1-66m-solana-flash-loan-exploit/","name":"Allbridge Core Pauses Bridge After $1.66M Solana Flash Loan Exploit — NFTEvening","type":"news_article","archive_url":"https://web.archive.org/web/20260803022625/https://nftevening.com/allbridge-core-pauses-bridge-after-1-66m-solana-flash-loan-exploit/","credibility":2,"archive_timestamp":"2026-08-03T02:26:25+00:00"},{"url":"https://beincrypto.com/allbridge-core-solana-exploit-paused/","name":"Allbridge Core Pauses Protocol After Attacker Drains More Than $1 Million — BeInCrypto","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://ambcrypto.com/allbridge-exploit-flash-loans-still-haunt-defi-1-65m-drained-via-usdc-usdt-pool/","name":"Allbridge exploit: Flash loans still haunt DeFi — AMBCrypto","type":"news_article","archive_url":"http://web.archive.org/web/20260721055804/https://ambcrypto.com/allbridge-exploit-flash-loans-still-haunt-defi-1-65m-drained-via-usdc-usdt-pool/","credibility":2,"archive_timestamp":"2026-07-21T05:58:04+00:00"},{"url":"https://www.tronweekly.com/allbridge-core-exploit-forces-bridge-pause/","name":"Allbridge Core Exploit Pauses Cross-Chain Bridge After $1.65M Solana Attack — TronWeekly","type":"news_article","archive_url":"http://web.archive.org/web/20260803112523/https://www.tronweekly.com/allbridge-core-exploit-forces-bridge-pause/","credibility":2,"archive_timestamp":"2026-08-03T11:25:23+00:00"},{"url":"https://blockzeit.com/allbridge-core-exploit-losses-estimated-at-around-1-65m/","name":"Allbridge Confirms Core Exploit, Losses Estimated Around $1.65M — Blockzeit","type":"news_article","archive_url":"http://web.archive.org/web/20260802013008/https://blockzeit.com/allbridge-core-exploit-losses-estimated-at-around-1-65m/","credibility":2,"archive_timestamp":"2026-08-02T01:30:08+00:00"},{"url":"https://allbridge.medium.com/allbridge-core-updates-following-the-relaunch-9f7716eeb5da","name":"Allbridge Core Updates Following the Relaunch — Allbridge Medium","type":"official","archive_url":"http://web.archive.org/web/20260727170405/https://allbridge.medium.com/allbridge-core-updates-following-the-relaunch-9f7716eeb5da","credibility":2,"archive_timestamp":"2026-07-27T17:04:05+00:00"},{"url":"https://medium.com/coinmonks/decoding-allbridge-570k-flash-loan-exploit-quillaudits-8da8dccd729d","name":"Decoding AllBridge $570K Flash Loan Exploit — QuillAudits / Coinmonks","type":"research","archive_url":"http://web.archive.org/web/20251126142142/https://medium.com/coinmonks/decoding-allbridge-570k-flash-loan-exploit-quillaudits-8da8dccd729d","credibility":2,"archive_timestamp":"2025-11-26T14:21:42+00:00"},{"url":"https://www.coinfabrik.com/blog/allbridge-audit-report/","name":"AllBridge Audit Report — CoinFabrik","type":"research","archive_url":"http://web.archive.org/web/20260313174036/https://www.coinfabrik.com/blog/allbridge-audit-report/","credibility":2,"archive_timestamp":"2026-03-13T17:40:36+00:00"},{"url":"https://www.halborn.com/audits/casper-association/casper---allbridge-fa8c33","name":"Bridge Contracts Audit — Halborn (Casper/Allbridge)","type":"research","archive_url":"http://web.archive.org/web/20260513003826/https://www.halborn.com/audits/casper-association/casper---allbridge-fa8c33","credibility":2,"archive_timestamp":"2026-05-13T00:38:26+00:00"},{"url":"https://www.cossacklabs.com/case-studies/smart-contract-security-audit-for-allbridge-cross-chain-bridge-with-tezos/","name":"Smart contract security audit for Allbridge Classic — Cossack Labs","type":"research","archive_url":"http://web.archive.org/web/20260518181947/https://www.cossacklabs.com/case-studies/smart-contract-security-audit-for-allbridge-cross-chain-bridge-with-tezos/","credibility":2,"archive_timestamp":"2026-05-18T18:19:47+00:00"},{"url":"https://nulltx.com/how-julys-210m-in-hacks-could-have-been-prevented","name":"How July's $210M In Hacks Could Have Been Prevented — NullTX","type":"news_article","archive_url":"http://web.archive.org/web/20260803022632/https://nulltx.com/how-julys-210m-in-hacks-could-have-been-prevented","credibility":2,"archive_timestamp":"2026-08-03T02:26:32+00:00"},{"url":"https://cryptorank.io/news/feed/605e8-allbridge-suspends-core-protocol-after-1-65m-solana-flash-loan-exploit","name":"Allbridge Suspends Core Protocol After $1.65M Solana Flash Loan Exploit — CryptoRank","type":"news_article","archive_url":"http://web.archive.org/web/20260728183028/https://cryptorank.io/news/feed/605e8-allbridge-suspends-core-protocol-after-1-65m-solana-flash-loan-exploit","credibility":2,"archive_timestamp":"2026-07-28T18:30:28+00:00"},{"url":"https://x.com/CryptoPatel/status/2079106282083205557","name":"Crypto Patel on X — attacker wallet addresses","type":"social_media","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://x.com/CertiKAlert/status/2079013163014770987","name":"CertiK Alert on X — exploit alert","type":"social_media","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://bitcoinke.io/2026/07/the-allbridge-exploit/","name":"DeFi Allbridge Urges Liquidity Providers to Withdraw Pool Funds in Latest Bridge Exploit — BitKE","type":"news_article","archive_url":"https://web.archive.org/web/20260817233829/https://bitcoinke.io/2026/07/the-allbridge-exploit/","credibility":2,"archive_timestamp":"2026-08-17T23:38:29+00:00"},{"url":"https://dailyhodl.com/2026/07/21/hacker-exploits-allbridge-core-draining-1660000-worth-of-crypto-from-cross-chain-stablecoin-bridge/","name":"Hacker Exploits Allbridge Core, Draining $1,660,000 — Daily Hodl","type":"news_article","archive_url":"http://web.archive.org/web/20260722054022/https://dailyhodl.com/2026/07/21/hacker-exploits-allbridge-core-draining-1660000-worth-of-crypto-from-cross-chain-stablecoin-bridge/","credibility":2,"archive_timestamp":"2026-07-22T05:40:22+00:00"},{"url":"https://www.cryptometer.io/news/allbridge-core-pauses-protocol-after-1-65-million-exploit-as-investigation-begins/","name":"Allbridge Core Pauses Protocol After $1.65 Million Exploit as Investigation Begins — Cryptometer","type":"news_article","archive_url":"https://web.archive.org/web/20261002104759/https://www.cryptometer.io/news/allbridge-core-pauses-protocol-after-1-65-million-exploit-as-investigation-begins/","credibility":2,"archive_timestamp":"2026-10-02T10:47:59+00:00"},{"url":"https://startupfortune.com/allbridge-core-loses-165-million-to-the-same-flash-loan-trick-twice/","name":"Allbridge Core Loses $1.65 Million to the Same Flash Loan Trick Twice — Startup Fortune","type":"news_article","archive_url":"http://web.archive.org/web/20260729014711/https://startupfortune.com/allbridge-core-loses-165-million-to-the-same-flash-loan-trick-twice/","credibility":2,"archive_timestamp":"2026-07-29T01:47:11+00:00"},{"url":"https://thedefiant.io/news/hacks/allbridge-halts-core-bridge-after-1-65m-flash-loan-exploit","name":"Allbridge Halts Core Bridge After $1.65M Flash Loan Exploit — The Defiant","type":"news_article","archive_url":"http://web.archive.org/web/20260726074434/https://thedefiant.io/news/hacks/allbridge-halts-core-bridge-after-1-65m-flash-loan-exploit","credibility":2,"archive_timestamp":"2026-07-26T07:44:34+00:00"},{"url":"https://finance.yahoo.com/markets/crypto/articles/allbridge-core-pauses-protocol-attacker-023505603.html","name":"Allbridge Core Pauses Protocol After Attacker Drains More Than $1 Million — Yahoo Finance","type":"news_article","archive_url":"http://web.archive.org/web/20260725192717/https://finance.yahoo.com/markets/crypto/articles/allbridge-core-pauses-protocol-attacker-023505603.html","credibility":2,"archive_timestamp":"2026-07-25T19:27:17+00:00"},{"url":"https://www.tradingview.com/news/coinpedia:19f5bacbd094b:0-allbridge-core-hit-by-1-65m-solana-exploit-funds-traced-to-ethereum/","name":"Allbridge Core Hit by $1.65M Solana Exploit, Funds Traced to Ethereum — TradingView/Coinpedia","type":"on_chain","archive_url":"https://web.archive.org/web/20260802013548/https://www.tradingview.com/news/coinpedia:19f5bacbd094b:0-allbridge-core-hit-by-1-65m-solana-exploit-funds-traced-to-ethereum/","credibility":2,"archive_timestamp":"2026-08-02T01:35:48+00:00"},{"url":"https://x.com/PeckShieldAlert/status/2079011150713561173","name":"PeckShieldAlert on X — exploit flagged, funds bridged Solana to Ethereum","type":"social_media","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.globalcryptopress.com/2026/07/the-hack-they-called-structurally.html","name":"The Hack They Called 'Structurally Impossible' in 2023 Just Cost Them $1.65M — GlobalCryptoPress","type":"news_article","archive_url":"https://web.archive.org/web/20260728184334/https://www.globalcryptopress.com/2026/07/the-hack-they-called-structurally.html","credibility":2,"archive_timestamp":"2026-07-28T18:43:34+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-merge-writer","created_at":"2026-08-02T23:28:14.235711+00:00","updated_at":"2026-10-31T23:44:18.703+00:00"},"source_quality":{"total":34,"tier1":0,"tier2":4,"tier3":3,"unrated":27},"follower_count":null,"content_updated_at":"2026-10-31T23:44:19.125Z","last_fact_checked_at":"2026-10-28T00:41:56.182Z","fact_check_next_allowed_at":"2026-11-04T00:41:56.182Z","update_next_allowed_at":null}