$1.65M Heist: Allbridge Falls Victim to Known Attack it Claimed to Have Fixed

DeFi security vulnerability rears its head again after Allbridge falls victim to a known attack. The Solana-based protocol lost approximately $1.65 million in stablecoins due to a flash loan pool-ratio manipulation, which is exactly the type of exploit it claimed to have fixed in May 2023.

The attackers borrowed $1.12 million from Kamino, a Solana lending protocol, and used that capital to rapidly swap USDC for USDT inside Allbridge's Solana pools, skewing the ratio between the two assets far away from where it should sit.

As a result of this distorted ratio, Allbridge's pricing math treated it as real, allowing the attacker to withdraw more value than they put in. The loop was repeated several times, with the difference being kept by the attackers until roughly $1.65 million had been drained from the pools.

The loss is considered modest by 2026 standards and nowhere near some of the larger bridge disasters seen during previous cycles. However, it highlights that a documented vulnerability with a known fix can remain open on a production chain for extended periods if left unchecked.