Allbridge Core Pauses Protocol After $1.65 Million Security Incident
L'essentiel
- Allbridge Core paused its cross-chain stablecoin bridge protocol after a security incident on Sunday, resulting in $1.65 million being drained from its Solana deployment.
- The attacker used a flash loan to manipulate exchange rates before bridging funds to Ethereum and privacy pools.
Résumé généré par IA
Pourquoi c'est important
Allbridge Core, a cross-chain stablecoin bridge, paused its protocol after a security incident on Sunday, resulting in a $1.65 million loss from its Solana deployment. This is at least the sixth attack targeting a cross-chain bridge since May.
Allbridge, the company behind cross-chain stablecoin bridge Allbridge Core, said it has paused the protocol as a precaution after a “security incident” that reportedly saw $1.65 million drained on Sunday.
The incident affected Allbridge Core’s Solana deployment, with the attacker having already bridged the stolen funds from Solana to Ethereum before moving them into privacy pools.
“Allbridge Core is experiencing a security incident,” it said in a post on X on Sunday. “We have paused the protocol as a precaution while we investigate. If you have liquidity in affected pools, please withdraw now.”
The Allbridge Core exploit is at least the sixth attack targeting a cross-chain bridge since May. Bridges are attractive targets for attackers because they often hold large pools of funds that back bridged assets on the destination blockchain.
Onchain Lens reported the attacker made a $1.12 million USDC (USDC) flash loan from Kamino, before rapid USDC/USDT swaps that distorted the Allbridge Core stablecoin pool’s exchange rate.
Related: Taiko reopens bridge after $1.7M exploit, says users made whole
The attacker then withdrew liquidity at manipulated rates, repaying the $1.12 million USDC loan and keeping the difference.
“The resulting pool imbalance created a temporary positive arbitrage window. If you took advantage of it, please consider returning funds… this will go directly toward compensating affected LPs,” it added.
This wasn’t the first time Allbridge Core was hit by a flash loan attack.
In April 2023, Allbridge was exploited for $573,000 through a flash loan attack on Allbridge’s pool on the BNB Chain. The attacker acted as both liquidity provider and swapper, and exploited a flaw in a smart contract that allowed them to manipulate swap prices, which led to $289,900 drained in Binance USD (BUSD) and $290,900 in USDt (USDT).
Cross-chain bridges targeted since May
In June, Taiko, an Ethereum layer-2 blockchain, urged its users to withdraw assets from the network’s bridges after attackers exploited one of its bridge protocols and stole $1.7 million.
Taiko reopened its bridge 11 days later after completing a four-step recovery plan.
Weeks before the Taiko incident, Secret Network was exploited through an “infinite mint” bug on a vulnerable smart contract, which created unbacked versions of Axelar-wrapped assets, resulting in a $4.67 million exploit.
Other recent bridge exploits included the Gravity Bridge, Verus Bridge and the Butter Network.
À surveiller
Perspective IA — des possibilités, pas des certitudes
Allbridge will continue its investigation into the security incident.
Très probable · En quelques jours
Allbridge may attempt to compensate affected liquidity providers.
Possible · En quelques semaines
Questions ouvertes
- How will affected LPs be compensated?
- What specific vulnerability was exploited?
- Can the stolen funds be traced/recovered?
