Allbridge paused its Core cross-chain bridge late on Sunday after an attacker drained about $1.65 million from its stablecoin pools on Solana. The team has urged liquidity providers to withdraw from the affected pools, and the stolen funds have been moved to Ethereum through privacy tools.

Two pieces of jargon do all the work in this story, and both are worth understanding, because the same combination has drained protocols repeatedly.

What a bridge is, and why it holds so much money

Blockchains cannot natively talk to each other. A cross-chain bridge is the plumbing that lets an asset on one chain be used on another: the bridge takes custody of your tokens on the origin chain and issues you a claim on the destination chain, backed by reserves it holds.

The consequence is structural. To serve users on both sides at any moment, a bridge must sit on large pools of assets on multiple chains simultaneously. That makes bridges among the most concentrated pots of value in the sector, guarded by code that has to be correct across several execution environments at once. They are targeted so often for the same reason banks are robbed.

What a flash loan is

A flash loan is an uncollateralized loan that is borrowed and repaid inside a single transaction. Blockchain transactions are atomic, meaning every step succeeds or the whole thing reverses as if it never happened. That property lets a lender hand over millions with no collateral: if the borrower fails to repay by the end of the transaction, the loan is simply undone.

Flash loans have legitimate uses, mostly arbitrage. They also hand anyone, with no capital of their own, temporary command of a very large balance. If a system's behavior depends on prices or ratios that a large enough trade can move, a flash loan is the tool for moving them.

How the attack worked

The attacker took a $1.12 million USDC flash loan from Kamino, a Solana lending protocol, then executed rapid swaps between USDC and USDT inside Allbridge's stablecoin pool.

The point of the swaps was not to trade. It was to skew the ratio of the two assets in the pool, which is what the pool uses to price them against each other. With the pool's internal exchange rate temporarily distorted, the attacker withdrew liquidity at the artificial rate, repaid the flash loan, and kept the difference. The stolen assets were then bridged from Solana to Ethereum and pushed through privacy protocols.

The incident was flagged by onchain security firms including PeckShield and CertiK, and by the analytics accounts Lookonchain and Onchain Lens.

The response, and its wording

Allbridge's public message is worth quoting because of how it frames what happened. The pool imbalance, the team said, "created a temporary positive arbitrage window. If you took advantage of it, please consider returning funds to the address below, this will go directly toward compensating affected LPs." It added that its goal is to "return all affected funds" to users.

Describing a deliberate price manipulation as an arbitrage opportunity someone took advantage of is a notably soft characterization. It is also a practical one: DeFi protocols have limited recourse against an anonymous attacker, and a polite request backed by a bounty has a better recovery record than a threat.

It has worked before

This is the second time Allbridge has lost funds to this exact pattern. On April 2, 2023, an attacker used a $7.5 million BUSD flash loan to manipulate USDT and BUSD pools on the BNB Chain deployment, draining roughly $573,000, split between $282,889 in BUSD and $290,868 in USDT.

That episode ended relatively well for the protocol. Allbridge offered the attacker a bounty and an escape from legal consequences, and the attacker returned 1,500 BNB, worth about $465,000, keeping the remainder as a white-hat bounty.

The recurrence is the part that matters for anyone assessing the risk. The 2023 attack was publicly analyzed in detail, the mechanism was well understood, and three years later a structurally identical manipulation of a stablecoin pool worked again on a different chain. Whether the 2026 attacker also accepts a bounty is unresolved; as of publication no funds had been returned.