{"id":24358,"date":"2026-07-22T04:47:25","date_gmt":"2026-07-22T04:47:25","guid":{"rendered":"https:\/\/nft.runfyers.com\/index.php\/2026\/07\/22\/allbridge-core-pauses-bridge-after-1-66m-solana-flash-loan-exploit\/"},"modified":"2026-07-22T04:47:25","modified_gmt":"2026-07-22T04:47:25","slug":"allbridge-core-pauses-bridge-after-1-66m-solana-flash-loan-exploit","status":"publish","type":"post","link":"https:\/\/nft.runfyers.com\/index.php\/2026\/07\/22\/allbridge-core-pauses-bridge-after-1-66m-solana-flash-loan-exploit\/","title":{"rendered":"Allbridge Core Pauses Bridge After $1.66M Solana Flash Loan Exploit"},"content":{"rendered":"

<\/p>\n

\n

Allbridge Core<\/strong> has paused operations following an exploit on Solana that drained approximately $1.66 million<\/strong> from the protocol\u2019s liquidity pools in a single transaction at around 17:51 UTC on July 19, according to a new announcement from the project.<\/span><\/p>\n

The incident is notable not only because of the size of the loss, but also because Allbridge Core handles significant usage, with over 890,000 wallets<\/strong> and a TVL of over $24 million according to figures on its homepage. This incident also reopens questions about the safety of liquidity pool-based bridge models.<\/span><\/p>\n

Allbridge Core pauses after Solana exploit<\/b><\/h2>\n

Immediately upon detecting the incident, Allbridge paused Core while investigating, noting that it took the team about 25 minutes to identify and begin shutting down the affected functions. The incident occurred on Solana and was confirmed by the project in a newly released technical post-mortem.<\/span><\/p>\n

\n

Allbridge Core is experiencing a security incident.
We have paused the protocol as a precaution while we investigate.<\/p>\n

If you have liquidity in affected pools, please withdraw now.<\/p>\n

The resulting pool imbalance created a temporary positive arbitrage window. If you took advantage\u2026 pic.twitter.com\/Ovg7yT35SM<\/a><\/p>\n

\u2014 Allbridge (@Allbridge_io) July 19, 2026<\/a><\/p>\n<\/blockquote>\n

Allbridge stated that the damage was contained to the two relevant pools, while private keys and user wallets were not compromised. In the initial phase of handling the issue, the project shifted its focus to limiting the spread rather than allowing the protocol to continue operating normally while the pool state was distorted.<\/span><\/p>\n

Pool-based swap design exposed a weakness<\/b><\/h2>\n

According to Allbridge\u2019s technical documentation, Core uses a stablecoin liquidity pool model with a virtual balance to maintain internal valuation pegs. This design allows the bridge to operate without wrapped assets, but it also leaves the system heavily dependent on how the pool handles the discrepancy between actual and recorded balances.<\/span><\/p>\n

According to the project, the vulnerability emerged when same-asset swaps were executed consecutively in the same pool. Each subsequent swap pushed the internal state further away from the actual liquidity, and when a flash loan was used as leverage, this deviation was large enough for the attacker to extract value before the rebalancing mechanism could react.<\/span><\/p>\n

This incident shows that the issue lies in the pool-based swap logic when exploited in a concentrated sequence of transactions, rather than in Solana as an independent infrastructure.<\/span><\/p>\n

About $1.66 million was drained from liquidity pools<\/b><\/h2>\n

According to the post-mortem, the exploit occurred at around 17:51 UTC on July 19, and the total value drained from liquidity pools was approximately $1.66 million, including about 1,118,239 USDC and 538,692 USDT. Based on the project\u2019s description, the attacker initiated the attack with a flash loan of around 1.12 million USDC from Kamino, then executed a series of swaps to distort the pool ratio before withdrawing liquidity at the skewed price.<\/span><\/p>\n