Allbridge pauses cross-chain bridge after $1.65M exploit

The Attack

The attacker allegedly used a flash loan and rapid swaps to manipulate the bridge’s stablecoin exchange rate. According to Lookonchain and Onchain Lens, the attacker made a $1.12 million USDC (USDC) flash loan from Kamino, before executing rapid USDC/USDT swaps that distorted the Allbridge Core stablecoin pool’s exchange rate.

The attacker then withdrew liquidity at the manipulated rates, repaid the $1.12 million USDC loan, and kept the difference.

“The resulting pool imbalance created a temporary positive arbitrage window. If you took advantage of it, please consider returning funds… this will go directly toward compensating affected LPs,” it added.

Previous Allbridge Exploit

This was not the first time Allbridge Core was hit by a flash loan attack. In April 2023, Allbridge was exploited for $573,000 through a flash loan attack on Allbridge’s pool on the BNB Chain. The attacker acted as both liquidity provider and swapper, and exploited a flaw in a smart contract that allowed them to manipulate swap prices. That attack drained $289,900 in Binance USD (BUSD) and $290,900 in USDt (USDT).

A warning was posted to the Allbridge Core website.

Related Incidents

In June, Taiko, an Ethereum layer-2 blockchain, urged its users to withdraw assets from the network’s bridges after attackers exploited one of its bridge protocols and stole $1.7 million. Taiko reopened its bridge 11 days later after completing a four-step recovery plan.

Weeks before the Taiko incident, Secret Network was exploited through an “infinite mint” bug on a vulnerable smart contract, which created unbacked versions of Axelar-wrapped assets, resulting in a $4.67 million exploit.

Other recent bridge exploits included the Gravity Bridge, Verus Bridge and the Butter Network.

Magazine: The British Virgin Islands are a top crypto hub no one ever talks about: Here’s why