Allbridge Core has paused its cross-chain stablecoin protocol after an attacker stole roughly $1.65 million from its Solana liquidity swimming pools, in keeping with safety corporations CertiK and PeckShield.
Allbridge is a bridge that lets customers transfer belongings between blockchains that don’t talk straight. Its Core product makes use of liquidity swimming pools to switch native stablecoins equivalent to USDC and USDT with out issuing wrapped variations of the belongings.
The attacker used a $1.12 million flash mortgage from Solana lending protocol Kamino to quickly swap USDC and USDT, manipulating the swimming pools’ inside ratios earlier than withdrawing belongings at favorable charges, in keeping with Onchain Lens. A flash mortgage is a mortgage taken and repaid throughout the similar transaction.
The stolen belongings have been bridged to an Ethereum deal with and dispersed throughout extra addresses. It isn’t at the moment clear how a lot stays underneath the attacker’s management.
Allbridge mentioned it paused the protocol whereas investigating, and informed liquidity suppliers to withdraw from affected swimming pools. The preliminary manipulation left the swimming pools imbalanced and created a short lived arbitrage alternative. Allbridge requested merchants who profited from the pricing distortion to return funds for LP compensation.
Allbridge suffered an analogous flash mortgage assault in 2023 that drained roughly $650,000 from its BNB Chain swimming pools. The agency later mentioned it recovered many of the funds and adjusted its liquidity and withdrawal calculations. Allbridge had raised $2 million in 2022 to broaden the bridge and fund safety audits.
