Allbridge Pauses Core Protocol After a Cross-Chain Exploit Estimated at $1.65 Million

In brief

Cross-chain bridge Allbridge paused its Core protocol on Sunday evening after what it called a security incident on its Solana deployment. The team's statement went out at 19:58 UTC on July 19; by early Monday UTC, security firms PeckShield and CertiK had flagged the incident and estimated the loss at roughly $1.65 million, with the funds bridged from Solana to Ethereum. Allbridge posted a return address, advised liquidity providers to withdraw, and said its goal is to return all affected funds. The team has not confirmed a total or explained the mechanism.

What happened

Allbridge said at 19:58 UTC on Sunday, July 19 that "Allbridge Core is experiencing a security incident" and that it had "paused the protocol as a precaution" while investigating. Its announcements channel repeated the notice at 20:37 UTC and advised liquidity providers to withdraw their positions. Allbridge Core is the project's cross-chain stablecoin transfer system; the incident, per the tracking accounts that followed it, centered on its Solana deployment.

Loss estimates evolved overnight. Onchain Lens put the figure at $1.1 million-plus at 00:29 UTC on July 20; PeckShield estimated roughly $1.65 million at 01:10 UTC and reported the funds had been bridged from Solana to Ethereum; CertiK published a Solana transaction hash and an Ethereum address associated with the exploiter; and Lookonchain reported the funds were swapped for ETH, linking explorer pages for addresses on both chains. CryptoBriefing, citing on-chain data flagged by Arkham Intelligence, reported the same movement pattern and a total of roughly $1.65 million. Allbridge has not confirmed a total.

The response, and a prior incident

Allbridge published an Ethereum return address alongside its statement and asked that funds taken during the incident be returned, saying compensation of liquidity providers is intended and, in a follow-up, that "our goal is to return all affected funds." The project used a similar response after an April 2023 flash-loan attack on its BNB Chain pools that caused about $573,000 in losses: it offered the attacker a bounty to come forward. Whether that approach produces a return here is unknown, and this report does not predict it.

The pause halts a protocol whose function is moving stablecoins between chains, so the practical impact extends to users with liquidity in Core pools — the group Allbridge specifically advised to withdraw.

What to watch

The concrete next signals: a technical post-mortem from Allbridge, an official loss figure, any movement on the return address or the exploiter's addresses, a timeline for unpausing the protocol, and the terms of any liquidity-provider compensation.

What we do not know

Allbridge has not described how the exploit worked; press accounts circulating a specific mechanism could not be bound to a capturable primary record at our cutoff, so no mechanism is asserted here. The exploiter has not been identified, and no attribution has been made by anyone in the reviewed record. The final loss figure remains a third-party estimate, the prospects for recovery are unknown, and the duration of the pause is unstated.