Intelligence Brief
Cross-chain bridge protocol Allbridge Core has paused operations after an exploit drained approximately $1.65 million from its Solana-based infrastructure. According to on-chain investigators, the attacker bridged the stolen funds from Solana to Ethereum shortly after the exploit, a common laundering technique that complicates asset recovery.
The exploit was not linked to compromised private keys or a flaw in the bridge itself. Instead, the attacker reportedly used a $1.12 million flash loan from Kamino Finance to manipulate pricing within Allbridge Core’s stablecoin pool. By distorting the pool’s exchange-rate calculations, the attacker withdrew liquidity at an inflated value, repaid the flash loan within the same transaction, and retained the remaining funds as profit.
#PeckShieldAlert @Allbridge_io Core was exploited for ~$1.65M.
The exploiter has bridged the stolen funds from #Solana to #Ethereum pic.twitter.com/ZOZysmJcAH
— PeckShieldAlert (@PeckShieldAlert) July 20, 2026
Intelligence Finding
The exploit reinforces that economic attacks remain one of DeFi’s weakest points. Rather than breaking cryptography or exploiting bridge infrastructure, the attacker manipulated protocol logic using temporary liquidity. The immediate transfer of funds from Solana to Ethereum also follows a familiar post-exploit pattern, allowing attackers to move assets across ecosystems before recovery efforts can begin. As DeFi protocols become increasingly interconnected, securing pricing mechanisms and third-party integrations is becoming just as critical as securing smart contracts themselves.
