Allbridge Core 2023 BNB Chain pool exploit
Attackers used flash-loan-funded deposits, withdrawals, and swaps to exploit flawed liquidity-accounting logic in Allbridge Core's BUSD and USDT pools on BNB Chain.
Incident facts
- Incident title
- Allbridge Core 2023 BNB Chain pool exploit
- Bridge
- Allbridge Core
- Incident date
- 2023-04-02
- Incident type
- Exploit
- Major incident
- Yes
- Affected chains
- BNB Chain
- Affected assets
- BUSD, USDT
- Attack category
- Liquidity Or Accounting Failure
- Reported loss
- Approximately $650,000 official postmortem; about $573,000 initial estimate
- Amount confidence
- High
- Loss amount basis
- Official Relaunch Analysis Prioritized With Initial Public Estimate Retained
- Recovery
- Partial Recovery
- Reimbursement
- Completed
- Restart
- Reopened
- Current outcome
- Active After Incident
- Postmortem
- Full
- Resolution
- Final outcome known
- Last reviewed
- 2026-07-28
- Last verified
- 2026-07-28
Amount and valuation
Allbridge later described approximately $650,000 drained across a series of attacks; contemporaneous reports initially estimated roughly $573,000.
The official later total includes a second smaller attack and is broader than the initial estimate.
series of BNB Chain pool attacksapproximately $650,000
Canonical total for the series.
initial BUSD and USDT drainabout $573,000
Retained as the initial public estimate.
Timeline events
Allbridge Core BNB Chain pool exploit disclosed2023-04-02
Allbridge shut down bridge operations after attacks manipulated its BUSD and USDT pool accounting on BNB Chain.
First attacker returned 1,500 BNB2023-04-03
An attacker accepted white-hat terms and returned 1,500 BNB, representing most of the initially reported loss.
Compensation plan announced2023-04-04
Allbridge said affected bridge users and liquidity providers would be compensated, beginning with transactions stuck during the emergency shutdown.
Allbridge Core relaunch and contract changes documented2023-05-30
Allbridge documented the redesigned pool logic, contract redeployment, recovery payments, and the return of Allbridge Core service.
Event type normalized from legacy descriptive value bridge_relaunched.
Allbridge recovery payments completed for submitted claims2023-05-30
Allbridge reported that recovery payments had been provided to all affected users who submitted the application form after most stolen funds were recovered.
The completion scope remains qualified to users who submitted the application form.
Evidence records
- Allbridge Core Updates Following the RelaunchAllbridge · Tier 1 · High reliability · primary · 2023-05-30Claim scope: Incident Case
Primary detailed analysis of the approximately $650,000 attack series, recovery payments, redesigned pool logic, and relaunch.
- Compensation Plan AnnouncementAllbridge · Tier 1 · High reliability · primary · 2023-04-04Claim scope: Reimbursement
Primary source for partial recovery, pool withdrawals, and planned compensation.
- Allbridge exploiter returns most of the $573K stolen in attackCointelegraph · Tier 2 · Medium reliability · secondary · 2023-04-04Claim scope: Recovery
Contemporaneous report for the initial $573,000 estimate and return of 1,500 BNB.
- Allbridge Core Updates Following the RelaunchAllbridge · Tier 1 · High reliability · primary · 2023-05-30Claim scope: Reimbursement
Primary qualified completion source: recovery payments to all affected users who submitted the application form.
- Allbridge Core Updates Following the RelaunchAllbridge · Tier 1 · High reliability · primary · 2023-05-30Claim scope: Incident Case
Event-scoped duplicate of bir_src_000053: Allbridge's official relaunch analysis documents the pool-accounting exploit, amount, shutdown, remediation, and return to service.
- Allbridge exploiter returns most of the $573K stolen in attackCointelegraph · Tier 2 · Medium reliability · secondary · 2023-04-04Claim scope: Incident Case
Event-scoped duplicate of bir_src_000055: contemporaneous reporting independently supports the initial Allbridge exploit amount and attacker-return context.
- Allbridge Core Updates Following the RelaunchAllbridge · Tier 1 · High reliability · primary · 2023-05-30Claim scope: Recovery
Event-scoped duplicate of bir_src_000053: the official analysis confirms that most stolen funds were recovered and used in the recovery process.
Source tiers describe evidence authority, not certainty for every claim. Tier 1 is the strongest source class; Tier 2 and Tier 3 provide progressively more secondary or supporting context. Source notes define what each record actually supports.
Known unknowns
- The exact unrecovered remainder after bounties and recovery payments is not itemized in this seed record.
Conflicting claims
Incident amount scope
Reported values: Approximately $650,000 across the attack series · Approximately $573,000 initial estimate
Current treatment: Use the later official $650,000 series total and retain $573,000 as the initial narrower estimate.
Help maintain incident aftermath records
Support recovery, reimbursement, restart, migration, shutdown, evidence, and correction checks.
Report a correction
Report missing evidence, incorrect dates, outcome changes, recovery details, reimbursement status, or broken links. GitHub Issues are preferred for structured review; the Google Form is available if you do not use GitHub.