Allbridge Core Halts Service After $1.65M Flash-Loan Exploit on Solana

Crosschain bridge protocol Allbridge Core has suspended operations after an attacker drained about $1.65 million from its Solana-based deployment. Allbridge said the pause is a precaution and advised liquidity providers in the affected pools to withdraw funds while the team investigates. Blockchain security firm PeckShield put losses at roughly $1.65 million. On-chain analysts said the attacker quickly moved the stolen assets from Solana to Ethereum, a crosschain hop that can complicate recovery and is often associated with laundering activity. Spot On Chain analyst Hupzy said the incident is unlikely to materially affect Solana's price given the size of the loss relative to the network's overall market value. Details point to a flash-loan price manipulation Another analyst said the exploit did not stem from a leaked private key or a traditional bridge compromise. Instead, the attacker allegedly took out a $1.12 million USDC flash loan from Kamino, then repeatedly swapped USDC and USDT inside Allbridge Core's stablecoin pool. Those trades reportedly skewed the pool's internal exchange-rate calculations, creating an artificial imbalance. The attacker then withdrew liquidity at the manipulated rate, repaid the $1.12 million flash loan within the same transaction, and kept the remaining difference as profit. One withdrawal was reported to be worth around $2.24 million. The analyst described the incident as a classic flash-loan-driven price manipulation attack, a DeFi vulnerability pattern seen since 2020, where a pool effectively relies on its own balances for pricing and can be distorted by temporarily borrowed capital. Separate reports suggested the stolen funds may have been routed through privacy-focused infrastructure, further reducing the odds of recovery. Bridge liquidity confidence in focus Market impact on SOL appears limited so far. Solana (SOL) traded at $76.66, up 1.06% over the past 24 hours, with $1.43 billion in daily volume. The bigger risk may be confidence in liquidity tied to crosschain bridges. Market participants will be watching whether the exploit triggers withdrawals from Solana-based bridge pools and leads to a broader pullback in bridge-related total value locked (TVL).