Allbridge Core Hit Again by Flash Loan Attack on Solana

Allbridge Core, a cross-chain bridge protocol, lost $1.65 million to a flash loan attack on its Solana stablecoin pools.

The attacker exploited a USDC and USDT pool operating side by side on Solana, despite Allbridge's promise in 2023 to deploy a single liquidity pool per blockchain, making same-transaction flash loan manipulation impossible.

In 2023, Allbridge published a postmortem of a nearly identical attack on its BNB Chain pools and committed to the architectural fix. However, the Solana deployment did not enforce this constraint.

The attack worked by borrowing $1.12 million in USDC from Kamino Finance using a flash loan, executing rapid swaps between USDC and USDT inside Allbridge's Solana pools, skewing the ratio between the two stablecoins, and withdrawing liquidity at the artificially favorable rate.