Allbridge has been hacked again for $1.65 million: the same vulnerability as in 2023
The cross-chain protocol Allbridge has once again fallen victim to an attack, which is essentially identical to the hack in 2023. The attacker withdrew $1.65 million from a liquidity pool on the Solana network, using a familiar scheme involving price manipulation via a flash loan. The most alarming aspect of this story is that the company had already addressed this vulnerability, but the fix was never applied to the code on Solana.
The incident occurred against the backdrop of the protocol's suspension. As noted by former NEAR core developer Vadim, the security patch was only implemented in the patched version of the contract, while the code deployed on the Solana network remained unchanged. Essentially, this is a classic case of "human error" in managing a multi-chain architecture.
Why the Protection Failed
Recall that in 2023, the Allbridge hack occurred on the BNB Chain. At that time, the attacker used a flash loan to distort the price of the stablecoin pool, withdrew funds at an artificial rate, and kept the difference. In response, the Allbridge team rewrote the withdrawal logic: they strictly limited redemption for liquidity providers on a "one-to-one" basis and moved everything to a single pool on the network.
Upon restart, the developers promised that executing an exploit within a single transaction would be impossible. However, three years later, the attack on Solana proceeded exactly that way. According to Vadim, the reason is mundane: the fix only affected the patched version, while the code for Solana was written in a different language and with different libraries. Each new network is essentially new code, and the security of one does not guarantee the security of another.
Mechanics of the New Attack
An analyst under the pseudonym DBCrypto detailed the scheme. The attacker did not spend a single dollar of their own funds: they took a flash loan of $1.12 million in USDC on the Kamino platform. These funds were then repeatedly run through the Allbridge Core stablecoin pool, distorting the exchange rate between USDC and USDT. After that, the attacker withdrew liquidity at the artificial price, repaid the loan to Kamino, and kept the difference.
DBCrypto called the entire scheme "an attack familiar to the market since 2020." The pool trusted its own price calculations, which it should not have trusted, and the attacker simply fed it false data.
Damage and Response
Third-party services confirmed the extent of the losses. According to PeckShield, the protocol was hacked for approximately $1.65 million. The stolen funds were quickly moved from Solana to Ethereum and exchanged for ETH. The Allbridge team suspended the protocol's operation and urged liquidity providers from the affected pools to urgently withdraw their funds.
Separately, the developers reached out to those who profited from the imbalance in the pool. The imbalance created a temporary window for arbitrage, and Allbridge asked for these funds to be returned to compensate the victims. Part of the stolen funds, as the team reported, went to privacy protocols RAILGUN and Near Intents, which significantly complicates tracking.
My comment: This case is a clear lesson for the entire industry. Multi-chain protocols must implement a unified audit and patch management system for all networks. Ignoring this principle leads to the repetition of the same mistakes, costing users millions of dollars.