Allbridge exploit: Flash loans still haunt DeFi - $1. 65M drained via USDC/USDT pool - AMBCrypto
Allbridge, a decentralized cross-chain bridge, suffered a $1. 65 million exploit that forced the suspension of Allbridge Core. This is after the attacker secured a $1. 12 million USD Coin [USDC] flash loan and. . .
Allbridge, a decentralized cross-chain bridge, suffered a $1. 65 million exploit that forced the suspension of Allbridge Core. This is after the attacker secured a $1. 12 million USD Coin [USDC] flash loan and later manipulated the USDC/USDT pool ratio. That distortion let the attacker withdraw liquidity at favorable exchange rates before moving the stolen assets from Solana [SOL] to Ethereum [ETH]. Later on, the protocol quickly halted Allbridge Core and urged liquidity providers to withdraw funds from affected pools. Source: XThose measures aimed to limit further losses while developers investigated the cause of the breach. Instead of exploiting cross-chain transfers, the attacker targeted the bridge’s liquidity pricing mechanism. This attack demonstratedthatflash-loan-typeexploits can stillaffectDeFiapplications withrobustsecurityfeatures. Additionally,it highlightedthe need forimprovedpricingresilienceandprotectionofliquidityin cross-chainenvironments asthey continue to growandbecome increasingly attractive destinations for largeamountsof capital. Flash loan triggered the liquidity drainThe exploit unfolded after the attacker secured a $1. 12 millionUSDCflash loan from Kamino. This enabled them to manipulate the Allbridge stable coin pool without risking their own capital. Using the borrowed funds, the hacker then did repeated USDC toTether [USDT]swaps. As a result, this caused distortion in the price of the stablecoin pool. Source: XAs the imbalance widened, each swap increased the value available for withdrawal under the manipulated exchange ratio. The attacker capitalized on that window by extracting 948,927. 53 USDT. The transaction trail then recorded a $2. 24 million USDC movement through the Allbridge bridge, illustrating how the manipulated liquidity quickly translated into one of the protocol’s largest single transfers before the funds moved beyond Solana. Allbridge Core’s TVL remained relatively stable near $21. 61 million before the exploit disrupted liquidity conditions. However, the protocol’s suspension quickly accelerated withdrawals as liquidity providers responded to the heightened risk. Source: DeFiLlamaThat pressure pushed TVL sharply down to $12. 78 million, marking one of its steepest single declines. The drop reflected more than lost funds because users also reduced capital exposure during the uncertainty. Consequently, recovery now depends on restoring confidence through stronger security measures, transparent updates, and renewed liquidity participation. Sustained TVL growth will ultimately signal whether users trust the protocol again. Final SummaryAllbridge’s $1. 65 million exploit exposed how flash-loan attacks can manipulate bridge liquidity and pricing mechanisms. Allbridge’s recovery now hinges on restoring TVL, strengthening security, and rebuilding user confidence.