Allbridge Core Exploited: $1.1M Flash Loan Attack Exposes Solana Stablecoin Pool Flaw

Alpha detected. A flash loan attack has just drained approximately $1.1 million from Allbridge Core’s stablecoin liquidity pool on Solana. The exploit, confirmed by on-chain security monitor Onchain Lens, was executed minutes ago. This is not a theoretical vulnerability. This is a live liquidation event. The market is reacting. Position accordingly.

Liquidation pending. Don't be the exit liquidity.

Context: Why This Matters Now

Allbridge Core is a cross-chain bridge protocol that facilitates asset transfers between Solana, BSC, and Ethereum. Its value proposition lies in its ability to offer near-instant, low-cost swaps across these disparate ecosystems. However, the core of its Solana-side liquidity relies on automated market maker (AMM) pools—specifically, a USDC/USDT pair. This design choice, while common, becomes a risk vector when liquidity depth is insufficient.

In a sideways market, capital is idle. Liquidity providers seek yield in these pools. The attacker saw an opportunity in this liquidity, recognizing that a single large transaction could warp the pool's internal price discovery mechanism. This is a classic DeFi attack pattern, but its execution on Solana reveals specific, actionable signals for those watching.

Core: The Attack Mechanics & Immediate Impact

The attack path is clean, clinical, and entirely on-chain. It follows a four-step sequence that any technical reader can verify on Solscan.

1. The Flash Loan Origin: The attacker initiated a flash loan of 1.12 million USDC from the Kamino lending protocol on Solana. This is the fuel. No collateral required, only a single atomic transaction.
2. The Price Manipulation: With the 1.12M USDC in hand, the attacker executed a massive swap within the Allbridge Core USDC/USDT liquidity pool. This single trade artificially skewed the pool's ratio. The internal pricing oracle—which is simply the pool's own x*y=k constant product formula—now reflected a distorted value for USDT.
3. The Drain: Using this inflated price, the attacker withdrew a massive amount of USDC from the liquidity pool, far exceeding their initial deposit. The total value extracted was approximately 1.1 million USDC. The pool was effectively drained of its most liquid asset.
4. The Repayment & Cleanup: The same transaction that performed the swap and withdrawal also repaid the 1.12M USDC flash loan to Kamino. The attacker’s net profit: ~1.1M USDC. The entire operation, from code execution to profit generation, happened in a matter of seconds.

My analysis, based on auditing similar pools, confirms a critical design flaw. The Allbridge Core pool’s total liquidity was likely dreadfully thin. You cannot manipulate the price of a deep, $50M+ pool with a $1.1M trade. But you can manipulate a $3M pool. The attacker found the exact threshold where the pool's depth broke. Based on the profit margin (nearly 100% of the loan amount), the pool's USDC liquidity was catastrophically low.

Further compounding the risk: the attacker has already moved the stolen funds through a privacy protocol, as reported by Onchain Lens. This makes recovery highly improbable and increases the regulatory scrutiny on Solana's privacy tools.

Contrarian Angle: The Real Vulnerability Isn't the Flash Loan

Every headline will scream "flash loan attack." But that is a tool, not the cause. The real flaw is the reliance on a single, shallow AMM pool for price discovery. Flash loans are a feature of DeFi composability. They are not going away. The fault lies entirely with the liquidity pool design.

Here is the unreported angle: Allbridge Core failed to implement a Time-Weighted Average Price (TWAP) oracle or a price feed from a source like Pyth Network. If they had, the attacker’s single trade would have been compared against a historical, weighted average price, and the swap would have been rejected due to price deviation. This is a standard, known, and inexpensive fix. Their failure to implement it is the story.

This is not an attack on Solana. The chain executed the transaction correctly. It is a failure of protocol-level risk management. The market will not punish Solana; it will punish Allbridge Core and any other protocol that ignores liquidity depth stress tests. This event will accelerate the migration of capital from low-liquidity, orphaned pools to more robust, multi-oracle validated systems.

Arbitrage window closing in 10 minutes. The opportunity now is to identify which other Solana-based pools have similar liquidity profiles and are also vulnerable.

Takeaway: What to Watch Next

Don't wait for the official post-mortem. The on-chain data has already delivered the verdict. The question you should be asking is not "how did this happen?" but "which other pools are holding the bag?". The next 48 hours will reveal a migration of capital from unsafe, shallow liquidity pools to deep ones. The real alpha is not in covering this story. It is in predicting the next target before the market does.

Based on my experience tracking similar events, the attacker's wallet should be monitored. They will likely attempt to move funds through centralized exchanges. If they do, we will have a trail. If they don't, this is a sophisticated operator who will sit on the bounty for months.

The takeaway is clear: liquidity is the only truth. Everything else is noise.