Allbridge suffered a loss of approximately $1.65 million due to a flash loan attack, and the cross-chain protocol has been suspended

According to Decrypt, the cross-chain bridge protocol Allbridge has suspended its Core protocol due to a flash loan attack, with the attacker having stolen approximately $1.65 million in assets from the Solana stablecoin liquidity pool.

According to analysis by blockchain security firms PeckShield and CertiK, the attacker borrowed $1.12 million in flash loan funds through the Solana lending protocol Kamino, and then manipulated the price mechanism within the Allbridge pool through multiple stablecoin exchange operations to exchange assets at a low price, subsequently transferring the funds across chains to an Ethereum address.

During the attack, the attacker exchanged several thousand dollars in USDT to obtain approximately $2.24 million in USDC, and then bridged the funds to Ethereum for further dispersal. It is currently unclear whether some of the funds can still be recovered.

Allbridge stated that the team has suspended the Core protocol for security reasons and has requested affected liquidity providers to withdraw their funds immediately. Due to the attack causing an imbalance in the liquidity pool, some traders profited from arbitrage opportunities. Allbridge has called on relevant users to return their profits, stating that the funds will be used to compensate affected LPs.

The team indicated that there is no further risk to user funds at this time and will release a detailed incident analysis report after completing the investigation, while also planning to relaunch the Core protocol after removing the liquidity pool. This is the second time Allbridge has encountered a similar flash loan attack. In April 2023, the protocol's BNB Chain liquidity pool suffered a loss of approximately $573,000 due to a similar vulnerability, after which the project team stated that they had recovered most of the funds and adjusted the liquidity calculation mechanism.