Allbridge Halts Core Bridge After $1.65M Flash Loan Exploit

§ 01 Executive Snapshot

• What: Allbridge halted its Core bridge due to a security incident involving a $1.65 million flash loan exploit.
• Who: Allbridge, blockchain security firms PeckShield and CertiK, and the unidentified attacker.
• Why it matters: This incident highlights vulnerabilities in cross-chain liquidity protocols and the risks associated with flash loan attacks.

§ 02 Key Developments

• Allbridge paused its Core bridge on July 20 after an attacker drained approximately $1.65 million from its Solana liquidity pools.
• The attacker executed a $1.12 million flash loan from the Solana lending protocol Kamino, which was then used to manipulate liquidity pool ratios.
• Allbridge warned liquidity providers to withdraw their funds from affected pools due to the security incident.

§ 03 Strategic Context

• The incident mirrors a previous flash loan attack in 2023, which drained roughly $650,000 from Allbridge's BNB Chain pools, prompting a commitment to improve security measures.
• Allbridge's multi-stablecoin pool configuration was intended to be eliminated to prevent similar attacks, but this exploit targeted the same setup that was meant to be reformed.

§ 04 Strategic Implications

• The immediate consequence is a halt in operations for Allbridge, raising concerns about the safety of cross-chain liquidity protocols.
• Long-term, this incident may lead to increased scrutiny and regulatory measures for flash loan mechanisms and cross-chain protocols.

§ 05 Risks & Constraints

• Potential regulatory scrutiny could arise from the repeated security incidents affecting Allbridge's protocols.
• The effectiveness of Allbridge's security measures, including the recent architecture changes, may be called into question following this exploit.

§ 06 Watchlist / Forward Signals

• Allbridge has not published a timeline for resuming operations, which will be critical for assessing the protocol's recovery.
• The resolution of the funds under the attacker's control and any subsequent actions taken by Allbridge to enhance security will be key indicators of the protocol's future viability.