Allbridge pauses cross-chain protocol after $1.65M flash loan attack

across the chain Bridge Allbridge temporarily suspended its protocol after an attacker drained approximately $1.65 million from its account Solana Liquidity pools in flash loan attack, according to blockchain security companies and the project itself.

Allbridge allows users to transfer assets between them Block chains Which does not communicate at all, and uses its primary product Baths Of the indigenous people stablecoins like US dollars and USDT Instead of minting coated coins. The team said on Sunday that it had “temporarily suspended the protocol as a precaution” during the investigation, and urged liquidity providers to withdraw funds from the affected pools.

In follow up tweetOlbridge noted that his team was “preparing a detailed analysis” and post-mortem report, Add that “There is no threat to user liquidity at this time” as it works to relaunch Core without liquidity pools.

How did that happen?

Olbridge confirmed earlier tweet The loss was estimated at $1.65 million by security firm PeckShield, which indicated that the attacker transferred funds from Solana to Ethereum.

Associate company CertiK Details of the methodwhich saw the attacker borrow $1.12 million through Flash loan of the Solana Kamino lending protocol, before making a rapid series of stablecoin swaps to distort the internal accounting that prices assets in Allbridge pools.

Mispricing the pools, the attacker exchanged a few thousand dollars of USDT for approximately $2.24 million in USDC before transferring the proceeds to an Ethereum address and dispersing it across other addresses. It’s not clear how much is left on hand.

The manipulation left Allbridge pools unbalanced, briefly allowing other traders to buy the mispriced assets — a “temporary positive arbitrage window,” the team said. the Decentralized finance The platform asked anyone who took advantage of that window to send funds to a specific address, saying it would “go directly toward compensating affected limited partners.” The team added that its “goal is to return all affected funds.”

Not the first time

It is the second time Allbridge has been arrested in this manner. In April 2023, a similar event occurred Exploit flash loans About $573,000 of it was drained BNP Series Baths. Project later said He recovered most of the money It reformulated how liquidity and withdrawals are calculated. Albridge It raised $2 million in 2022 To expand the bridge and fund security audits.

Bridges and the liquidity pools that feed them have long been among the most targeted infrastructure for DeFi. More than $840 million It was lost to DeFi hacks in just the first five months of 2026, with cross-chain systems repeatedly causing some of the largest single losses. Just last month, a bridge was created between Axelar and Secret Network Exhausted $4.67 million after attackers exploited an “Infinite Mint” bug in a custom token contract.

The Allbridge Protocol remains on pause, and how much of the $1.65 million can be recovered will depend on tracking the funds raised — and on whether the arbitrage traders it appealed actually return the money.