Allbridge Core Halts Cross-Chain Bridge After $1.65M Flash Loan Exploit Drains Stablecoin Pool

Allbridge Core has pulled the plug on its cross-chain bridge after an attacker weaponized a flash loan to warp the protocol’s stablecoin exchange rate and walk away with roughly $1.65 million — the latest in a string of DeFi price-manipulation hits on an already rattled market, according to CoinTelegraph.

How the Attack Worked

The playbook here is depressingly familiar. The attacker borrowed funds through a flash loan — an uncollateralized DeFi instrument that has to be repaid within the same transaction block — then fired off a rapid sequence of stablecoin swaps designed to shove the bridge pool’s exchange rate sideways before it could snap back. By the time the dust settled, they had extracted roughly $1.65 million in a single atomic transaction, leaving the pool reeling. Stablecoin bridge pools keep drawing this kind of attack for a reason: deep liquidity, and exchange rates that can be nudged hard by large, fast swaps executed before the pool has any chance to rebalance.

Protocol Response

Allbridge Core’s response was the DeFi equivalent of pulling a fire alarm. The team paused the bridge — a standard emergency measure that kills all transactions while they dig into the vulnerability. Cross-chain transfers are frozen. Funds already in transit may sit stuck until the protocol either resumes operations or drops a remediation plan.

Context: Another Blow to a Rattled Market

Worse timing is hard to imagine. The incident follows the larger Ostium hack, in which an attacker laundered 10,540 EETH$1,902.79▲1.98% through Tornado Cash after draining $24 million from an Arbitrum vault — a story this desk covered earlier. The broader mood in the market reflects exactly that kind of accumulated dread; the Fear & Greed Index is parked at 29/100, deep in “Fear” territory, with total market capitalisation at $2,297.07 billion and 24-hour trading volume at $43.7 billion. Major stablecoins have held their pegs through the turbulence — UUSDT$0.9992▲0.00% at $0.9992, UUSDC$0.9998▲0.00% at $0.9999 — so no spillover into wider stablecoin instability, at least not yet. CoinGecko also references the incident.

What Happens Next

The picture is still full of holes. Allbridge Core has not published a post-mortem naming the specific stablecoin pool targeted, the blockchains involved, or the exact transactions. No on-chain analytics firm — PeckShield, CertiK, or BlockSec — had released a transaction breakdown at time of publication; nor is it known whether the protocol has reached out to the attacker or floated a bug-bounty offer angling for a white-hat return of funds. Users are waiting on an official post-mortem and a hard timeline for when the bridge comes back online.