Allbridge Core paused on Solana after Kamino flash-loan drains ~$1.65M

Cross-chain stablecoin bridge Allbridge Core paused its Solana deployment on Sunday, July 19, 2026, after an attacker used a $1.12M USDC flash loan from Kamino to distort the bridge's USDC/USDT pool and walk away with roughly $1.65M in liquidity, according to on-chain trackers. The Allbridge team confirmed the incident on X later the same day and asked liquidity providers to withdraw immediately. PeckShield surfaced the exploit and the follow-on Solana→Ethereum bridging: PeckShieldAlert on X.

What happened

The exploit hit Allbridge Core's Solana stablecoin pool. According to reconstructions by Cointelegraph, BeInCrypto and Crypto Briefing, the attacker:

1. Took out a $1.12M USDC flash loan from the Solana money market Kamino.
2. Ran a series of rapid USDC/USDT swaps through Allbridge Core's stablecoin pool, deliberately pushing the pool's internal exchange rate away from the 1:1 stable-to-stable peg.
3. Withdrew liquidity from the same pool at the manipulated rate, receiving more value than they deposited.
4. Repaid the Kamino flash loan inside the same atomic transaction and kept the difference.

The Allbridge team's own X statement — "Allbridge Core is experiencing a security incident. We have paused the protocol as a precaution while we investigate. If you have liquidity in affected pools, please withdraw now" — was posted within hours of the drain. The rest of the Allbridge Core deployments on other chains were paused as a precaution, not because the same primitive was hit on them.

Mechanism — flash-loaned stable-pool imbalance

The Allbridge Core stable pool prices USDC↔USDT locally against its own reserves. When one leg of the pool is pushed far from parity by a large enough swap, the reverse leg pays out more than it should. A flash loan makes that manipulation cheap: the attacker borrows an amount larger than any honest LP would put through, imbalances the pool for a few block slots, withdraws at the skewed rate, and repays the loan before block-end. Nothing in the exploit chain requires holding the borrowed capital for more than the length of a single Solana transaction.

This is the same class of attack — pool-imbalance via flash-loaned swap — that hit Allbridge in 2023, when a ~$570K flash-loan attack forced the bridge into a first pause. The 2023 remediation added slippage and rate checks; the July 2026 incident is a fresh path around them, not a repeat of the same bug.

On-chain trail

• Bridging: PeckShield reported that the exploiter bridged the stolen funds from Solana to Ethereum shortly after the drain.
• Obfuscation: Coverage from LCX and Cointelegraph describes the Ethereum-side funds being routed into privacy pools to break the trail.
• Compensation address: Allbridge asked traders who profited from the imbalance to return funds to 0x01a494079DCB715f622340301463cE50cd69A4D0 on Ethereum, saying the address will feed the LP compensation program.
• Attacker attribution: no actor has claimed responsibility. Allbridge has not published a specific EOA for the drain contract; on-chain trackers have flagged the flow but not attributed it further.

Numbers block

- Protocol            : Allbridge Core (cross-chain stablecoin bridge)
- Affected deployment : Solana
- Date of exploit     : 2026-07-19 (Sunday)
- Drained             : ~$1.65M in pool value
- Flash-loan source   : Kamino, $1.12M USDC
- Attack primitive    : stablecoin pool imbalance via rapid USDC/USDT swaps
- Bridging path       : Solana → Ethereum, then routed through privacy pools
- Team response       : protocol paused; LPs told to withdraw; compensation
                        address 0x01a494079DCB715f622340301463cE50cd69A4D0
                        on Ethereum
- Prior Allbridge inc.: 2023 flash-loan attack, ~$570K, same pool-imbalance
                        class

Impact

Allbridge Core's stablecoin liquidity is the balance sheet the bridge quotes cross-chain USDC↔USDT swaps against. A ~$1.65M dent isn't system-ending — Allbridge weathered a similar-shape hit in 2023 and rebuilt LP participation — but every incident of this class writes down whatever risk premium LPs were charging over the safer end of the bridge market, and Allbridge Core is not the safe end. The team's decision to pause the whole deployment rather than only the exploited pool means bridge users see the outage regardless of the pool they were using.

Action checklist

1. Allbridge Core LPs — withdraw from any Solana pool while the deployment is paused. Watch the compensation-plan announcement on the Allbridge Medium (the 2023 remediation used a phased, LP-weighted refund; expect a similar shape here).
2. Integrators quoting through Allbridge Core — treat the Solana route as offline until the team confirms the pool math has been re-parameterised or reserves have been topped up. Route through alternative stable bridges in the interim; do not silently degrade to a stale price feed.
3. On-chain traders who benefited from the pool imbalance without knowing it — the compensation address is 0x01a494079DCB715f622340301463cE50cd69A4D0. Returning inadvertent gains protects you from being caught up in downstream sanctions or subpoena traffic if the exploit is later ruled a hack rather than a market misprice.
4. Auditors of stablecoin AMM/bridge pools — the failure primitive is a swap-then-withdraw around a slippage/rate guard that assumed honest flow sizes. Any pool that (a) mints/burns LP against a local rate quote and (b) does not throttle within-block imbalance is on the same class of curve.

Context — the bridge attrition, restated

Cross-chain bridges have been the highest-loss surface in DeFi since 2022 (Ronin, Wormhole, Nomad, Multichain, Poly, Orbit, Radiant, deBridge — the list is long and public on Rekt and DefiLlama's hacks tracker). The July 19 Allbridge Core drain is at least the sixth cross-chain-bridge incident since May 2026 — following the Ostium OLP-vault signer breach on Arbitrum (see our Ostium OLP vault coverage) and the Across Protocol Solana relayer attack (see Across Protocol Solana). The category's problem isn't the audit surface of any one bridge — it's that stablecoin liquidity and cross-chain routing sit behind a stack of rate quotes, message relays and signer sets that no single audit fully covers.

Watch two follow-ups: the Allbridge post-mortem (which pool, which check missed, and whether Kamino throttles similar flash-loan sizes going forward) and any pause coordination on other stable-pool bridges running the same curve.

Sources:

• PeckShieldAlert on X — first on-chain confirmation of the drain and Solana→Ethereum bridging.
• Cointelegraph — Allbridge Core Pauses Cross-Chain Bridge after $1.65M Exploit — attack sequence and Allbridge statement.
• BeInCrypto — Allbridge Core Pauses Protocol After Attacker Drains More Than $1 Million — Kamino flash-loan source, pool-imbalance mechanic.
• Crypto Briefing — Allbridge exploited for $2M, funds bridged from Solana to Ethereum — cross-chain flow and privacy-pool routing.
• LCX — Allbridge pauses cross-chain bridge after $1.65M exploit — compensation address and prior Allbridge incident.
• Allbridge on Medium — team communication channel for post-mortem and compensation plan.