Allbridge, a cross-chain bridge protocol, has paused its operations following a flash loan attack that resulted in the theft of approximately $1.65 million from its Solana liquidity pools. This incident marks the second significant security breach for Allbridge, underscoring persistent vulnerabilities within the decentralized finance (DeFi) ecosystem’s critical cross-chain infrastructure.
The attack, which occurred on July 19, 2026, involved an exploiter using a flash loan to manipulate asset prices within Allbridge’s Solana liquidity pools. According to blockchain security firms PeckShield and CertiK, the attacker borrowed $1.12 million via a flash loan from Kamino, a DeFi platform, and then swapped stablecoins, gaining approximately $2.24 million in USDC. These stolen funds were subsequently bridged to the Ethereum network.
In response, Allbridge paused its protocol as a precautionary measure while it investigates the incident. The project stated that there is currently no threat to users’ liquidity and that its goal is to return all affected funds. Allbridge has also appealed to arbitrage traders who may have profited from the temporary price imbalance created by the attack to return the funds to a designated address, aiming to compensate the affected liquidity providers (LPs).
This latest exploit echoes a similar incident in April 2023, when a flash-loan attack drained around $573,000 from Allbridge’s BNB Chain pools. At that time, the project reported recovering most of the funds and implementing changes to its liquidity and withdrawal calculations. The recurring nature of these security failures raises concerns about the robustness of Allbridge’s security protocols and the broader challenges in securing cross-chain bridge technology.
The DeFi landscape continues to grapple with significant security risks. In the first five months of 2026 alone, over $840 million was lost to DeFi hacks, with cross-chain systems frequently being the target of some of the largest single losses. Just last month, a bridge between Axelar and Secret Network lost $4.67 million due to an ‘infinite mint’ bug. These incidents highlight that bridges and the liquidity pools that support them remain among DeFi’s most-targeted infrastructure.
Allbridge’s Core product, which utilizes pools of native stablecoins like USDC and USDT rather than minting wrapped tokens, was affected in this latest attack. The project is preparing a detailed notable move and post-mortem report of the incident. However, significant uncertainties remain regarding the full recovery of the stolen $1.65 million, including how much can be clawed back and whether arbitrage traders may return their profits. The success of Allbridge’s recovery efforts will depend on tracing the bridged funds and the willingness of arbitrage traders to return their profits.
The repeated exploits at Allbridge and other DeFi platforms underscore the systemic risks inherent in cross-chain interoperability. While these bridges are essential for seamless asset transfer between disparate blockchains, they also present complex attack vectors. The ongoing investigation and Allbridge’s appeal to arbitrageurs highlight the difficult and uncertain path to recovery in the aftermath of such security breaches, leaving users and investors to navigate a high-risk environment.
Why This Matters
The materials describe a narrow update: An attacker used a flash loan to manipulate asset prices within Allbridge’s Solana liquidity pools, enabling them to swap stablecoins and drain approximately $1. How much of the $1.65 million can be clawed back.
Broader Context
Source materials place the factual news in this context: Allbridge lets users move assets between blockchains that don’t natively communicate, and its Core product uses pools of native stablecoins such as USDC and USDT rather than minting wrapped tokens.
Leave a Reply