Allbridge Core lost approximately $1.65 million in a flash loan exploit on the Solana network, marking the cross-chain bridge protocol's second major security incident via the same attack vector, according to a CoinMarketCap report.

The repeat attack method lands a fresh blow to a protocol category already scarred by record-breaking losses across recent cycles, and any incident at a returning name amplifies scrutiny on cross-chain infrastructure standards.

How does a flash loan exploit work?

Flash loans are uncollateralized loans that borrowers must take and repay within a single blockchain transaction. Attackers chain these loans with price-oracle dependency or pool-imbalance mechanics to extract value from a target smart contract inside the same atomic operation. The compressed settlement timeframe leaves almost no room for defensive pause mechanisms or manual circuit breakers. The attack pattern exploits DeFi composability: the same feature that lets legitimate strategies chain lending, swapping, and bridging across protocols also lets attackers construct adversarial sequences at machine speed.

Why is this the second exploit for Allbridge Core?

Allbridge Core suffered an earlier flash-loan-related exploit in April 2023 on the BNB Chain, which prompted a contract upgrade and a partial reimbursement framework. A repeat occurrence indicates either insufficient remediation of the underlying assumptions or new deployment surface that replicated the original vulnerability pattern. The protocol operates liquidity pools across multiple chains, including Solana and BNB Chain, to facilitate cross-chain swaps. Each chain deployment carries its own contract surface, oracle feed, and validator configuration, multiplying the audit coverage that the team needs to maintain.

What does a repeat exploit mean for users?

A second incident at the same protocol compresses the timeline for user trust erosion. Total value locked typically drops within hours of a public acknowledgment, and withdrawal queues can compound the loss as users race to exit. For institutional desks and market makers, a pattern of repeat incidents triggers counterparty review and reduced routing through the affected bridge.

Competing cross-chain messaging and bridge protocols — including Wormhole, LayerZero-based systems, and Stargate — stand to absorb redirected volume, reinforcing the market-structure concentration that follows high-profile bridge failures.

What needs to happen next?

The protocol's operators have not yet published a post-mortem identifying the exploited Solana contract, the on-chain transaction signature, or a reimbursement framework at the time of writing. Forensic disclosure is the industry baseline for bridge incidents; delay beyond the standard 72-hour window typically correlates with deeper TVL declines. Governance token holders will likely face a vote on whether treasury reserves or a future emission schedule covers the loss, and a credible third-party audit of the Solana deployment — beyond internal remediation — is the minimum signal needed to retain institutional routing.

The exploit confirms that bridge security remains an unresolved market-structure problem, with each new incident reshaping how capital allocates across the cross-chain stack.