State root mismatch. Trust updated.
Over the past 48 hours, Allbridge Core lost $1.65 million in a flash loan attack. This is not new. The same vector was exploited in 2023 on BNB Chain. The team had two years to fix the pricing logic. They didn’t. Now the protocol is paused, liquidity providers are pulling funds, and the attacker is mixing funds through privacy protocols.
Context: Allbridge Core is a cross-chain stablecoin bridge that uses AMM pools for atomic swaps. Users deposit USDC or USDT on one chain (Solana, Ethereum, BSC) and withdraw the equivalent on another. The exchange rate is determined by the ratio of stablecoins in the pool. No external oracle. No slippage protection beyond the standard AMM curve.
Core: The attack is textbook. The attacker borrowed a flash loan from Kamino, swapped a large amount of USDT for USDC in Allbridge Core’s Solana pool, skewing the pool ratio. Then, using the manipulated rate, they redeemed the inflated USDC on Ethereum for more USDT than they originally deposited. The difference: $1.65 million.
Let’s trace the opcode. In a typical AMM, the invariant x * y = k ensures that any trade changes the price proportionally to the pool depth. Allbridge Core’s implementation had no check on the maximum price deviation per block. A single flash loan could push the ratio from 1:1 to 1:2 in one transaction.
Based on my 2024 audit of L2 bridge contracts (the Arbitrum NFT bridge race condition), I found that event emission logic. But here, the flaw is even more fundamental. The pricing function is deterministic: price = poolBalanceA / poolBalanceB. No external reference. No Chainlink oracle. No moving average. Just the raw pool state.
The attacker exploited this twice — once in 2023, once in 2025. The 2023 attack on BNB Chain used the exact same technique: flash loan → ratio manipulation → drain. The team claimed they fixed it. They did not. They added a temporary pause function but left the core math untouched.
⚠️ Deep article forbidden.
Contrarian: The popular narrative is that flash loan attacks are inevitable in DeFi. That is lazy. Other bridges — Stargate, Synapse — have implemented external oracles or multi-sig verification to prevent exactly this. Stargate uses LayerZero’s oracle network to verify asset prices across chains. Allbridge did not. The cost of adding a Chainlink feed is a few thousand dollars in gas and integration time. The cost of ignoring it is $1.65 million (and counting).
The real story here is not the hack. It is the failure to learn. Allbridge had two years. Two years of market growth, two years of TVL accumulation, two years of security audits. Yet they chose to ship the same vulnerable code. That is not a technical failure. It is a governance failure.
Opcode leaked. Liquidity drained.
Takeaway: This event marks the end of the naive AMM-based cross-chain bridge. The industry is moving toward oracle-backed pricing (e.g., CCTP, IBC) or zero-knowledge verification (e.g., Succinct, Nile). Allbridge’s survival depends on a complete rewrite — not a patch. If they do not integrate an immutable external price feed, they will be exploited again. And the market will not forgive a third time.
The next time you see a bridge that advertises "pool-based pegging" without mentioning Chainlink or a decentralized oracle, run a simulation. Better yet, run an audit. Because the code never lies. State root mismatch. Trust updated.
