Allbridge Core Suspends Operations After $1.65 Million Exploit

Allbridge Core Suspends Operations Following Security Incident

Allbridge Core has paused its cross-chain stablecoin protocol after a significant security incident on Solana, estimated by PeckShield to have resulted in a loss of about $1.65 million.

Details of the Exploit

The attack involved the use of a $1.12 million USDC flash loan which was utilized to disrupt stablecoin pool rates. This manipulation led Allbridge to issue a warning urging liquidity providers to withdraw their funds while the incident is investigated.

Investigation of Transferred Funds

According to reports, the attacker transferred the stolen funds from Solana to Ethereum. The incident appears to be related to the manipulation of Allbridge Core’s USDC/USDT liquidity pool. Onchain Lens noted that the attacker borrowed the flash loan, rapidly swapped assets, and withdrew liquidity at altered rates.

Response from Allbridge

In public statements, Allbridge confirmed the halt of operations as a precautionary measure. They directed users with liquidity in affected pools to withdraw immediately. The team also highlighted that the resulting imbalance in liquidity pools created an arbitrage opportunity, allowing some traders to profit from the disrupted pricing.

Allbridge has requested those who benefited from this discrepancy to consider returning the funds to a specified recovery address, as these assets would help compensate affected liquidity providers. As of now, the reopening date for Allbridge Core remains unspecified, and no technical report has been released.

Context of Previous Attacks

This incident is not the first for Allbridge. It follows an earlier attack in April 2023, where a security breach resulted in an estimated loss of $573,000. Following that incident, Allbridge managed to recover around $465,000 via a white-hat reward.

The ongoing issues with cross-chain protocols highlight a broader trend of security vulnerabilities. For context, other notable incidents include the Verus-Ethereum bridge attack in May, which lost more than $11.5 million, and the Transit Finance exploit, culminating in losses of approximately $1.88 million.

Allbridge has yet to clarify whether the recent exploit shares any technical similarities with these previous security breaches.