Allbridge Core pause after reported $1.65M Solana exploit

Allbridge Core, a cross-chain stablecoin bridge operated by Allbridge, said on 2026-07-20 that it had paused the protocol as a precaution after what it described as a security incident.^[1] The same reporting stated that the incident affected Allbridge Core’s Solana deployment and that the reported loss reached $1.65 million.^[2][4] In the immediate response, Allbridge also said that users with liquidity in affected pools should withdraw immediately while the matter was investigated.^[7]

The mechanism described in the available public record was not presented through a primary forensic report, but secondary reporting attributed the exploit to price manipulation within the bridge’s stablecoin exchange process.^[3] Cointelegraph reported that the attacker allegedly used a flash loan and rapid swaps to manipulate the bridge’s stablecoin exchange rate.^[3] The same report, citing Onchain Lens, stated that the flash loan was a $1.12 million USDC loan sourced from Kamino.^[5] On the present record, this sequence suggests a transient distortion of pricing conditions rather than a conventional private-key compromise or direct contract drain, although the dossier does not provide transaction-level evidence sufficient to independently reconstruct each step.^[3][5]

According to the same reporting, the alleged execution path proceeded from the flash loan into rapid swaps that changed the effective exchange conditions used by the protocol.^[3] Once those rates had reportedly been manipulated, the attacker then withdrew liquidity at the distorted prices, repaid the $1.12 million USDC loan, and retained the difference.^[5][6] In functional terms, the reported loss therefore appears to have depended on temporary balance-sheet asymmetry created within a single transaction flow or tightly coupled sequence, a pattern commonly associated with flash-loan-enabled market manipulation, though as of 2026-07-20 the dossier had not established the exact transaction hash, contract address, or full on-chain path.^[5][6]

The incident was reported as specific to the Solana deployment of Allbridge Core rather than to all deployments or all chains supported by the protocol.^[4] That distinction matters because the available account did not describe a generalized failure across the bridge’s entire architecture; instead, it localized the event to one deployment while the protocol operator paused the system as a precaution.^[1][4] The brief also associated the event with two recurring structural lessons in the archive: centralized_validator_set and absence_of_withdrawal_monitoring. Those labels do not by themselves prove the immediate exploit path, but they indicate that the incident has been categorized within known bridge-risk and controls-failure patterns rather than as an isolated anomaly without precedent.

Reporting further stated that the stolen funds were bridged from Solana to Ethereum before moving into privacy pools.^[1] In post-exploit analysis, such onward movement is usually relevant because it can complicate tracing and recovery, but the present dossier did not include the transaction identifiers needed to verify the route independently.^[1] Nor did it establish whether the movement to Ethereum and privacy pools occurred in one continuous sequence or through intermediate addresses. As a result, the public record supports only a limited conclusion: the funds were reported to have left the affected Solana environment and to have been moved onward in a manner consistent with concealment or obfuscation efforts.^[1]

The documented consequences were immediate but narrowly described. Allbridge paused Allbridge Core after the incident and publicly instructed liquidity providers in affected pools to withdraw.^[1][7] The reported financial impact was $1.65 million.^[2] No court filing, regulator statement, recovery announcement, or formal attribution was included in the dossier, and no user-loss count was established. On the available record, the material consequences therefore consisted of the reported drain from the Solana deployment, the precautionary halt of the protocol, and the operational disruption implied by the withdrawal warning and investigation status.^[1][2][4]