Allbridge Core has paused its stablecoin routing operations on Solana after a flash loan exploit extracted an estimated $1.65 million from affected liquidity pools. The team has advised liquidity providers to avoid the impacted routes while engineers investigate the incident.
On-chain tracking indicates the attacker used a $1.12 million USDC flash loan from Kamino Finance. The borrowed capital was routed through rapid USDC and USDT swaps that temporarily distorted the pool’s internal pricing.
Allbridge Core is experiencing a security incident.
We have paused the protocol as a precaution while we investigate.If you have liquidity in affected pools, please withdraw now.
The resulting pool imbalance created a temporary positive arbitrage window. If you took advantage… pic.twitter.com/Ovg7yT35SM
— Allbridge (@Allbridge_io) July 19, 2026
Pool Imbalance Created a Short Extraction Window
The manipulated exchange rate allowed the attacker to withdraw liquidity at artificially favorable prices before repaying the flash loan. The remaining difference became the exploiter’s profit, leaving liquidity providers exposed to the pool imbalance.
Flash loans were not the vulnerability by themselves. Instead, the attack exploited how Allbridge Core responded to concentrated single-transaction liquidity pressure, showing that its pricing mechanics could be pushed out of alignment before the pool rebalanced.
The proceeds later moved from Solana to Ethereum and through privacy-oriented routing infrastructure. That transfer pattern makes direct recovery more difficult, although the fund movements remain visible enough for security analysts to continue tracing.
Recovery Effort Focuses on Affected Liquidity Providers
Allbridge has asked traders who benefited from the temporary arbitrage conditions to return the funds. Any recovered capital would be used to compensate liquidity providers affected by the exploit.
The appeal does not guarantee full recovery or immediate pool normalization. Restoring operations will require the team to reconcile remaining reserves, identify the exact pricing failure and determine whether additional safeguards are needed.
The incident echoes Allbridge Core’s April 2023 BNB Chain exploit, when an attacker used similar liquidity-provider and swapper mechanics to manipulate pool pricing and drain approximately $573,000.
That history raises questions about whether the routing layer contains a recurring structural weakness under flash loan pressure. Stablecoin bridges rely on pooled liquidity and accurate internal accounting, making delayed rebalancing or weak price controls especially dangerous.
Allbridge Core remains paused on Solana while the team prepares remediation and a technical postmortem. The next critical updates will be the confirmed loss, affected LP accounting, pricing-control changes and a timeline for restoring the suspended routes.