Allbridge hacked again for $1.65 million: how an old vulnerability returned via Solana
The cross-chain protocol Allbridge has once again fallen victim to an attack, losing approximately $1.65 million. The most alarming aspect of this incident is that the attackers used the same vector as in 2023. As it turned out, the fix that the team implemented after the first hack never reached the code on the Solana network.
Why did the protection fail?
In 2023, the attack occurred on the BNB Chain. At that time, hackers manipulated the liquidity pool through flash loans: they borrowed funds, distorted the stablecoin pool rate, and withdrew the difference at a false price. Allbridge responded promptly — it rewrote the withdrawal logic, strictly limiting redemptions for liquidity providers on a "one-to-one" basis and switching to a single pool per network.
However, as noted by former NEAR core developer Vadim, the patch only protected the patched version. The code for Solana was written in a different language and remained vulnerable. Three years passed, and the attack repeated — exactly following the same scheme.
Mechanics of the new hack
An analyst under the nickname DBCrypto detailed the transaction. The attacker carried out the entire operation within a single transaction, without investing a single dollar of their own funds:
- First, they took a flash loan of $1.12 million USDC on the Kamino platform.
- Then, these funds were repeatedly run through the Allbridge Core stablecoin pool, distorting the USDC/USDT exchange rate.
- After that, liquidity was withdrawn at an artificially inflated price.
- The hacker repaid the Kamino loan and kept the difference (net profit) for themselves.
"This is an attack familiar to the market since 2020," comments DBCrypto. "The pool trusted its own price calculations, which it should not have trusted, and the attacker simply fed it false data."
Scale and reaction
The security service PeckShield confirmed losses of $1.65 million. The funds were quickly moved from Solana to Ethereum, where the hacker began exchanging them for ETH. According to Lookonchain, part of the stolen funds passed through privacy protocols RAILGUN and Near Intents, significantly complicating tracking.
The Allbridge team immediately suspended the protocol's operation and urged liquidity providers from the affected pools to urgently withdraw their funds. The developers also appealed to arbitrage bots that had profited from the temporary imbalance, asking them to return the funds to compensate affected users.
Expert opinion: This incident is a vivid example of how multi-chain protocols pay for insufficient security unification. Fixing a vulnerability on one network does not guarantee protection on another if the codebase differs. Allbridge should have conducted a full audit of all smart contract versions, rather than relying on a single patch. The market has once again received a painful but important lesson: security tolerates no compromises or "patchwork" solutions.