Allbridge Core 2026 Solana pool exploit
On July 19, 2026, Allbridge Core's Solana stablecoin liquidity pools were exploited. Allbridge confirmed that an attacker withdrew $1.65 million, paused Core during the investigation, and later relaunched Core without liquidity pools using CCTP and LayerZero transfer routes.
Incident facts
- Incident title
- Allbridge Core 2026 Solana pool exploit
- Bridge
- Allbridge Core
- Incident date
- 2026-07-19
- Incident type
- Exploit
- Major incident
- Yes
- Affected chains
- Solana
- Affected assets
- USDC, USDT
- Attack category
- Liquidity Or Accounting Failure
- Reported loss
- $1.65 million
- Amount confidence
- High
- Loss amount basis
- Reported By Project
- Recovery
- Unknown
- Reimbursement
- Unknown
- Restart
- Reopened
- Current outcome
- Active After Incident
- Postmortem
- Available
- Resolution
- Unresolved
- Last reviewed
- 2026-08-10
- Last verified
- 2026-08-10
Amount and valuation
Allbridge's official statement confirmed that an attacker withdrew $1.65 million from Allbridge Core liquidity pools; contemporaneous reporting located the affected USDC/USDT pools on Solana.
Use the first-party $1.65 million withdrawal figure as canonical. Secondary technical reporting is retained for chain, asset, and mechanism corroboration rather than used to increase the amount.
$1.65 million withdrawn from Allbridge Core liquidity pools$1.65 million
Canonical incident amount from Allbridge's official statement.
Why this remains unresolved
- Final attacker-fund recovery is not established in the admitted reviewed sources.
- Final affected-liquidity-provider compensation and reconciliation are not established.
- The announced longer-term transition away from the then-current Core and Classic form was not yet a completed shutdown or migration at review time.
Timeline events
Allbridge Core Solana pool exploit disclosed2026-07-19
Allbridge disclosed a security incident affecting Core, paused the protocol, told affected liquidity providers to withdraw, and subsequently confirmed that an attacker had withdrawn $1.65 million from Core liquidity pools.
The later relaunch is represented at incident level in this batch because the first-party Telegram rendering proves reopening but does not expose an independently stable calendar date for a separate reopen event.
Allbridge Core relaunched without liquidity poolsApprox. 2026-07-20
Allbridge reported that Core was back up using CCTP and LayerZero transfer routes without liquidity pools after the July 2026 Solana pool exploit and pause.
Approximate day precision is preserved from the admitted first-party relaunch evidence; this event does not resolve attacker-fund recovery or LP reimbursement.
Evidence records
- Allbridge Core security incident and protocol pauseAllbridge · Tier 1 · High reliability · primary · 2026-07-19Claim scope: Event
First-party incident notice supporting the Core pause, affected liquidity pools, resulting pool imbalance, and the stated intention to direct returned arbitrage funds toward affected LPs.
- Official Statement from the Allbridge teamAllbridge · Tier 1 · High reliability · primary · Approx. 2026-07-20Claim scope: Amount
First-party statement confirming the $1.65 million attacker withdrawal, the planned pool-less Core relaunch through CCTP and LayerZero, and the accelerated transition toward Allbridge Next.
- Allbridge Core relaunch on CCTP and LayerZeroAllbridge · Tier 1 · High reliability · primary · Approx. 2026-07-20Claim scope: Restart
First-party relaunch notice stating that Allbridge Core was back up on CCTP and LayerZero without liquidity pools and that a technical post-mortem was available on X.
- Allbridge Pauses Cross-Chain Protocol After $1.65M Flash Loan AttackDecrypt · Tier 2 · High reliability · secondary · 2026-07-20Claim scope: Incident Case
Secondary corroboration for the July 19 incident date, Solana deployment, USDC/USDT pool impact, flash-loan-funded pool-ratio manipulation, and movement of proceeds toward Ethereum.
- Allbridge Core relaunch on CCTP and LayerZeroAllbridge · Tier 1 · High reliability · primary · Approx. 2026-07-20Claim scope: Restart
Event-scoped first-party copy of bir_src_000290 supporting the discrete Core relaunch milestone on CCTP and LayerZero without liquidity pools.
Source tiers describe evidence authority, not certainty for every claim. Tier 1 is the strongest source class; Tier 2 and Tier 3 provide progressively more secondary or supporting context. Source notes define what each record actually supports.
Known unknowns
- A first-party technical post-mortem exists on X, but its unarchived X URL is not admitted in this batch because the accepted risky-host ceiling must not regress.
- The implementation-level failure is therefore not promoted beyond the broader reviewed liquidity/accounting category.
- The final recovery, LP compensation, and transition outcomes require later review.
Help maintain incident aftermath records
Support recovery, reimbursement, restart, migration, shutdown, evidence, and correction checks.
Report a correction
Report missing evidence, incorrect dates, outcome changes, recovery details, reimbursement status, or broken links. GitHub Issues are preferred for structured review; the Google Form is available if you do not use GitHub.