Allbridge: The Flash-Loan Trick It Fixed in 2023 Took $1.65M in 2026

At about 17:51 UTC on Sunday 19 July 2026, a single transaction on the Solana blockchain borrowed $1.12 million, pushed two stablecoin pools out of shape, took out more than it had put in, paid back the loan and left. When it was over, Allbridge Core had lost about $1.65 million: 1,118,239 USDC and 538,692 USDT, according to the project's own post-mortem. Within half an hour the team had stopped the bridge and posted on X: "If you have liquidity in affected pools, please withdraw now."

It was the second time. In 2023 Allbridge had been robbed the same way, had written publicly about exactly how it would stop it happening again, and had named the fix. Three years later the fix was not there on the network that got hit.

Allbridge is a bridge, a service that moves money between blockchains that cannot otherwise talk to each other, much like a currency exchange booth at a border. Allbridge Core specialised in stablecoins, tokens designed to always be worth one US dollar, such as USDC (issued by Circle) and USDT (issued by Tether). The project, co-founded by Andrey Velikiy, said Core had served more than 890,000 wallets and held over $24 million in deposits before the attack.

Who was robbed

Core did not create copies of tokens. Instead, on each blockchain it kept liquidity pools, tills of real stablecoins put up by ordinary depositors known as liquidity providers, or LPs. When someone sent USDC from Ethereum to Solana, Core took their USDC into the Ethereum till and paid out from the Solana till. LPs earned a share of the fees in return; Velikiy said they received 80% of protocol fees and the project kept 20%. The money taken on 19 July came out of those tills. The victims were the LPs, mostly individuals earning a modest return on spare digital dollars.

How a free loan breaks a till

The tool was a flash loan. A flash loan is a loan with no collateral and no credit check, on one condition: it must be borrowed and repaid inside the same transaction, which takes well under a second. If it is not repaid, the whole transaction is cancelled as if it never happened. In stock market terms, imagine a bank lending any amount to anyone, provided the money is back before the trade even settles. It lets someone with no capital act like a fund with millions, for one moment.

The attacker borrowed about 1.12 million USDC from Kamino, a Solana lending service. Core's pools did not check prices against the outside world. They set the exchange rate between USDC and USDT from an internal bookkeeping figure, a "virtual balance" meant to keep the two at roughly one to one. Allbridge's post-mortem said the flaw appeared when several swaps of the same kind ran one after another in the same pool: each one pushed the bookkeeping further away from the real money in the till. With the borrowed millions, the attacker ran a burst of USDC-for-USDT swaps until the rate was badly wrong, then withdrew liquidity at the distorted price and kept the difference. It is the digital version of finding a bureau de change whose rate board updates only from its own sales, buying until the board shows nonsense, and cashing out at the board's price.

Arbitrage traders, people who profit from small price gaps between markets, also piled in while the pools were out of balance. Allbridge asked them to send their gains back to compensate LPs. Velikiy later told the Ukrainian outlet Incrypted that the appeal had failed.

The promise from 2023

On 1 and 2 April 2023 an attacker did almost the same thing to Allbridge's pools on BNB Chain, another blockchain, using a flash loan to distort the ratio between BUSD and USDT. That attack took about $573,000. Allbridge negotiated, and the attacker returned 1,500 BNB, worth about $465,000, keeping the rest as a so-called white-hat bounty, a reward for giving most of it back. No legal action followed.

Allbridge's post-mortem listed several repairs, including corrected calculations, withdrawal caps and an automatic shutdown for badly unbalanced pools. Its main promise sat under the heading "One asset per chain": "To prevent the possibility of flash loan attacks, we will deploy a single liquidity pool per blockchain." With only one stablecoin per network, there would be no ratio to distort inside one transaction.

The Solana deployment in 2026 held two stablecoins, USDC and USDT, side by side. That was exactly the setup the 2023 fix was supposed to rule out. Allbridge has not publicly explained why. TechTimes, which compared the two post-mortems, suggested either USDT was added on Solana after 2023 without the rule or the rule was read differently for Solana. Neither has been confirmed. Allbridge said the fault lay in its pool logic, not in Solana itself.

Where the money went, and what Allbridge did next

About $1.63 million was traced. Part was bridged to Ethereum and then moved through Railgun, a privacy service that hides who sent what, as well as NEAR Intents and the private "Orchard" pool of Zcash, a privacy coin. That is the modern equivalent of passing marked notes through several bureaux in several countries. Allbridge said it was working with the tracing firms AMLBot, Global Ledger and Crystal. Unlike 2023, it had no attacker to bargain with: Velikiy said the attacker's jurisdiction was unknown.

The damage spread beyond the stolen sum. Velikiy said deposits in Core fell by more than 40% as LPs pulled out, and total losses including the arbitrage were still being counted. "We don't have a button to restore everything to how it was," he said. He called liquidity pools "a constant magnet for hackers".

So Allbridge gave up on them. Within two days Core restarted at roughly half capacity with the pools switched off, sending transfers through Circle's CCTP, which destroys USDC on one chain and issues fresh USDC on the other, and through LayerZero, a messaging network that carries instructions between chains. The team said Core and the older Allbridge Classic would stop operating in their current form within three months, folding into Allbridge Next, its newer system. It said compensation would come first from any recovered funds and possibly from protocol fees. As of 16 October 2026 no recovery, compensation payout or arrest had been publicly announced.