Allbridge exploit: Flash loans still haunt DeFi – $1.65M drained via USDC/USDT pool

Allbridge, a decentralized cross-chain bridge, suffered a $1.65 million exploit that forced the suspension of Allbridge Core. This is after the attacker secured a $1.12 million USD Coin [USDC] flash loan and later manipulated the USDC/USDT pool ratio.

That distortion let the attacker withdraw liquidity at favorable exchange rates before moving the stolen assets from Solana [SOL] to Ethereum [ETH]. Later on, the protocol quickly halted Allbridge Core and urged liquidity providers to withdraw funds from affected pools.

Those measures aimed to limit further losses while developers investigated the cause of the breach. Instead of exploiting cross-chain transfers, the attacker targeted the bridge’s liquidity pricing mechanism.

This attack demonstrated that flash-loan-type exploits can still affect DeFi applications with robust security features.

Additionally, it highlighted the need for improved pricing resilience and protection of liquidity in cross-chain environments as they continue to grow and become increasingly attractive destinations for large amounts of capital.

Flash loan triggered the liquidity drain

The exploit unfolded after the attacker secured a $1.12 million USDC flash loan from Kamino. This enabled them to manipulate the Allbridge stable coin pool without risking their own capital.

Using the borrowed funds, the hacker then did repeated USDC to Tether [USDT] swaps. As a result, this caused distortion in the price of the stablecoin pool.

As the imbalance widened, each swap increased the value available for withdrawal under the manipulated exchange ratio. The attacker capitalized on that window by extracting 948,927.53 USDT.

The transaction trail then recorded a $2.24 million USDC movement through the Allbridge bridge, illustrating how the manipulated liquidity quickly translated into one of the protocol’s largest single transfers before the funds moved beyond Solana.

Allbridge Core’s TVL remained relatively stable near $21.61 million before the exploit disrupted liquidity conditions. However, the protocol’s suspension quickly accelerated withdrawals as liquidity providers responded to the heightened risk.

That pressure pushed TVL sharply down to $12.78 million, marking one of its steepest single declines. The drop reflected more than lost funds because users also reduced capital exposure during the uncertainty.

Consequently, recovery now depends on restoring confidence through stronger security measures, transparent updates, and renewed liquidity participation. Sustained TVL growth will ultimately signal whether users trust the protocol again.

Final Summary

• Allbridge’s $1.65 million exploit exposed how flash-loan attacks can manipulate bridge liquidity and pricing mechanisms.
• Allbridge’s recovery now hinges on restoring TVL, strengthening security, and rebuilding user confidence.