Allbridge Pauses Protocol After $1.65M Exploit Drains Stablecoin Liquidity Swimming pools

Allbridge has requested customers to withdraw liquidity instantly after a $1.65 million exploit.

Cross-chain stablecoin bridge, Allbridge Core, suffered a safety exploit that resulted in losses of roughly $1.65 million, in keeping with blockchain safety agency PeckShield.

The agency stated the attacker has already bridged the stolen funds from Solana to Ethereum.

Allbridge Responds

Allbridge confirmed experiencing a safety incident and that the protocol has been paused as a precaution whereas the staff investigates. The venture additionally urged customers with liquidity in affected swimming pools to withdraw their funds instantly.

In line with Allbridge, the exploit created a brief constructive arbitrage alternative attributable to an imbalance within the affected liquidity swimming pools. The staff requested anybody who benefited from the arbitrage to voluntarily return the funds, whereas including that they might be used to compensate affected liquidity suppliers.

In the meantime, blockchain safety agency Onchain Labs explained that the exploit started with a $1.12 million USDC flash mortgage obtained from Kamino on Solana. The attacker allegedly used speedy USDC and USDT swaps to control Allbridge Core’s stablecoin pool ratios earlier than withdrawing liquidity at distorted charges, repaying the flash mortgage inside the similar transaction, and extracting the funds. Onchain Labs added that the stolen property had been later moved via privateness protocols for mixing.

Allbridge has confronted the same assault earlier than. In April 2023, the protocol misplaced round $573,000 in a flash mortgage exploit on BNB Chain. The attacker took benefit of a bug within the sensible contract to control token swap costs, which allowed them to steal about $289,900 in BUSD and $290,900 in USDT.

A String of Bridge Exploits

Cross-chain bridges stay a favourite goal for hackers. In April, Syndicate Labs misplaced about $330,000 value of SYND tokens after a leaked non-public key let an attacker take management of its Commons bridge contracts.

You may additionally like:

A month later, the Verus-Ethereum bridge was exploited for greater than $11 million as a result of one in every of its contracts didn’t validate transactions correctly, though a lot of the funds had been later returned.

In June, the Ethereum Layer 2 community Taiko informed customers to drag their property from its bridges after attackers stole $1.7 million from one in every of its bridge protocols.