Allbridge exploit analysis

On 19 July 2026, the Allbridge blockchain bridge was exploited for $1.66 million in a flash-loan attack. The attacker took advantage of a flaw in the project's logic that reprices assets against one another, exploiting the fact that the same repricing happened even when borrowing an asset against collateral denominated in the same token. By manipulating the project's internal pricing logic, the attacker was able to push the asset's actual price away from reality and pocket $1.66 million in proceeds.

The mechanism was an internal-pricing flaw. Allbridge's bridge architecture uses internal prices to track the relative value of bridged assets. The attacker discovered that the protocol applied the same repricing rule when a user borrowed an asset using the same asset as collateral, which is normally a degenerate situation the protocol should ignore. By exploiting that edge case, the attacker was able to borrow against an artificially-deflated or inflated view of the collateral, depending on the direction of the manipulation. The attack fits a familiar flash-loan pattern: borrow real capital, manipulate an internal price, borrow or withdraw against the manipulated price, repay the flash loan, and pocket the difference.

The figure is the protocol's own. The web3isgoinggreat account put the loss at $1.66 million. The Allbridge project's tweet thread acknowledged the attack at the same figure. Blockzeit reported the loss at "around $1.65M". The Defiant reported "$1.65M". The protos.com weekly summary grouped the Across Allbridge Exploit with the Across and TeleSwap losses in the same week at "$5.7M" total.

The response was a protocol pause and a public statement. Allbridge paused the protocol after the drain, made a tweet thread acknowledging the loss, and engaged with security firms. The team did not announce a recovery plan, a bounty, or an identification of the attacker in the reviewed reporting. The protocol subsequently resumed operations.

Compared with the other 2026 bridge incidents in the corpus, the Allbridge case is the smallest of the July 2026 cluster at $1.66 million. The same week also saw the Across relayer compromise at $3.35 million and the Wanchain-Midnight bridge loss of $9-10 million. The protos.com weekly summary at the time grouped them as "Across, Allbridge, TeleSwap lost $5.7M to bridge hacks in past week", which suggests the per-protocol numbers may be lower than the headline combined figure suggests depending on which Bell frame is used. A separate DeFiHackLabs reproduction titled "AllbridgeCCTP - phantom deposit via unverified message attestation" addresses a different August 2026 incident on Allbridge rather than the July flash-loan exploit, and is not the same attack.