Allbridge Core — Kamino flash loan stablecoin pool manipulation

Timeline: On July 19, 2026, an attacker executed a flash loan attack against Allbridge Core's Solana stablecoin pools, draining approximately $1.65M. Using a Kamino flash loan of ~$1.12M USDC, the attacker performed rapid USDC↔USDT swaps to distort the pool's internal exchange rate, then withdrew liquidity at the manipulated rate before repaying the flash loan within the same transaction. The stolen funds were bridged from Solana to Ethereum destination wallet 0x651591b68A9c9650FB23F642162353306281ffDe. Allbridge immediately paused the Core protocol and urged LPs in affected pools to withdraw. The team asked traders who profited from the arbitrage imbalance to return funds to recovery address 0x01a494079DCB715f622340301463cE50cd69A4D0 for LP compensation. This was Allbridge Core's second flash-loan exploit — the same attack class as a 2023 BNB Chain incident (~$573K). Subsequent on-chain analysis (Arkham Intelligence) showed stolen funds being laundered via Maya Protocol/MayaChain in batches of 7–44 ETH, a process still ongoing as of July 28, 2026.