On July 20, an attacker executed a flash loan price manipulation on Allbridge Core’s Solana pool. The result? $1.1 million in stolen USDC. The code didn’t fail—the assumptions did.
Allbridge Core is a cross-chain bridge that lets users move assets between Solana, BSC, and Ethereum. Its Solana side hosts a USDC/USDT liquidity pool, relying on a simple constant product AMM (x*y=k) for price discovery. The attacker borrowed 1.12 million USDC from Kamino, a Solana lending protocol, swapped it against the pool to distort the exchange rate, then drained excess liquidity before repaying the flash loan. The entire transaction happened in seconds, atomically. The attacker netted roughly 1.1 million USDC, which was then funneled through a privacy protocol to obfuscate the trail.
This is not new. We saw the same playbook in 2020 with bZx, in 2021 with PancakeBunny, and in 2022 with Mango Markets. The technique is so well-documented that calling it “innovative” would be an insult to the security researchers who flagged it years ago. What is interesting here is not the attack itself, but what it reveals about the state of DeFi engineering on Solana in mid-2025.
Core: The Mechanical Cruelty of Shallow Pools
Let’s walk through the mechanics. The attacker initiated a flash loan of 1.12 million USDC from Kamino. That loan was then swapped for USDT on Allbridge Core’s USDC/USDT pool. Because the pool’s total liquidity was small—likely under $3 million based on the profit size—the swap caused a severe price impact. The AMM formula (x*y=k) dictates that after the swap, the ratio of USDC to USDT is skewed. The attacker now held a large amount of USDT at a manipulated price, and the pool’s internal price showed USDC as artificially cheap. The attacker then used that distorted price to withdraw liquidity—essentially buying the pool’s USDC at a discount—before repaying the flash loan and walking away with the difference.
This is a textbook “liquidity depletion” attack. It works because the pool treats its own internal price as gospel. No external oracle (like Pyth or Switchboard) was consulted. No time-weighted average price (TWAP) was implemented. The pool’s code simply trusted that any trade reflects genuine supply and demand—a dangerous assumption when a single entity can atomically control both sides of the trade.
Based on my audit experience during DeFi Summer, I’ve seen this pattern repeatedly: projects assume liquidity depth will protect them, but a single flash loan of $1M can penetrate most Solana pools. The real problem is not the flash loan; it’s the failure to decouple pricing from transient liquidity events. Code is truth. Intent is fiction. Allbridge Core’s code allowed this manipulation because it was designed for convenience, not resilience.
Why Solana? Why Now?
Some will say this is another blow to Solana’s security narrative. That is lazy. Solana’s chain itself handled the transaction correctly—high throughput, low latency, no reorgs. The vulnerability is at the application layer. Every chain has them. Ethereum had them. BSC had them. The difference is that Solana’s composability makes these attacks faster and cheaper to execute. A flash loan on Solana costs cents in fees, and the atomic execution happens in under a second. That speed is a feature, but it also amplifies risk when protocols cut corners.
What the Bulls Got Right (And Wrong)
Let me play contrarian for a moment. Allbridge Core is not a scam. It’s a legit cross-chain bridge with real usage. The team likely believed that its pool depth—say $2–3 million—was sufficient to deter manipulation. After all, why would someone risk capital to gain only 1.1x returns? The answer: because they can do it risk-free with a flash loan. The bulls also argue that the industry is moving toward better oracle integration, and that this event will accelerate adoption. That is true. But it is cold comfort to the liquidity providers who just lost their funds.
What the bulls got wrong is the assumption that a single audit or a reasonable TVL suffices. Economic attacks bypass conventional code audits. They exploit the market mechanics, not the Solidity. The attacker did not reverse-engineer the contract; they simply read the whitepaper and saw that the pool had no price protection. Minted nothing, promised everything. The promise of “deep liquidity” was a fiction written into the code.
Takeaway: The Ledger Keeps Score
Allbridge Core will likely recover—patch the pool, add a TWAP oracle, maybe compensate victims. But the pattern is damning. Every bull market bakes in the same mistakes: speed over security, convenience over robustness. Gas fees don’t lie. People do. The ledger keeps score, and this one shows a $1.1M debit against the protocol’s reputation.
Expect more attacks like this until projects stop treating AMM pricing as a reliable oracle. The next one might not be on Solana. It might be on Base, or Arbitrum, or some new L2 that promises cheap composability. The code will be elegant. The marketing will be loud. But the underlying assumption—that liquidity depth is a substitute for price verification—will remain the same. And the attackers will be waiting.
The only question is: which pool will bleed next?
