Cross-chain bridge protocol Allbridge suspended operations after an attacker exploited its Solana-based stablecoin pools using a flash loan, draining roughly $1.65 million before shifting the funds to Ethereum, according to blockchain security researchers.
How the Attack Unfolded
The exploit centered on Allbridge's stablecoin liquidity pools on the Solana network. According to security firms tracking the incident, the attacker deployed a flash loan — a borrowing mechanism that allows large sums to be taken and repaid within a single transaction — to manipulate the pricing dynamics of the pools.
By distorting the balance between the paired stablecoins, the attacker was able to trick the protocol into releasing more value than the deposited assets warranted. The stolen proceeds were then bridged from Solana over to Ethereum, a common laundering step that complicates recovery efforts.
A single flash loan was all it took to knock the bridge's stablecoin pools off balance and siphon off $1.65 million.
Protocol Response
In the wake of the breach, Allbridge moved to pause its cross-chain protocol, halting activity while its team investigates the vulnerability. Temporarily suspending operations is a standard defensive measure designed to prevent further losses and preserve remaining liquidity.
The incident once again highlights the persistent security risks facing cross-chain bridges, which have repeatedly been targeted because they concentrate large amounts of value across multiple networks.
Key details of the exploit include:
- A flash loan was used to distort Allbridge's Solana stablecoin pools
- Roughly $1.65 million was drained in the attack
- Stolen funds were moved from Solana to Ethereum
- The protocol was paused following the breach
Ongoing Risks for Bridges
Bridges remain among the most frequently exploited pieces of infrastructure in decentralized finance, with attackers drawn to the pooled assets that make them essential connective tissue between blockchains. Flash loan-based manipulations, in particular, have become a recurring method for exploiting pricing flaws in liquidity pools.
For users, the episode underscores the importance of monitoring official protocol channels for updates on the status of funds and any potential reimbursement plans as Allbridge's investigation continues.