A hacker manipulated the swap mechanics of a liquidity pool on the cross-chain stablecoin bridge Allbridge Core, looting $1.66 million worth of digital assets over the weekend.
In a post-mortem of the incident, Allbridge notes the hacker used flash loan and exploited the swap logic of its Solana (SOL) liquidity pools.
The attacker borrowed approximately $1.12 million worth of the dollar-pegged stablecoin USDC from lending protocol, then swapped that USDC into rival stablecoin USDT.
The hacker then conducted a series of five “same-asset swaps,” exchanging 100,000 USDT for progressively less of the same stablecoin.
Allbridge notes the swap path treated an input and output of the same token like any other pair.
“Because both sides of a same-asset swap reference the same pool, the accounting of the two halves diverged, and each iteration pushed the pool’s internal pricing further out of line with reality.”
After heavily skewing the price of Tether’s stablecoin in the liquidity pool, the hacker managed to swap only 4,000 USDT for 2.24 million USDC. The attacker then repaid the flash loan and kept the surplus 1,118,239 USDC and 538,692 USDT, totalling roughly $1.66 million worth of stolen crypto.
Allbridge notes the liquidity pool’s imbalance safeguard was “configured permissively,” enabling mispricing to balloon to profitable levels before it triggered.
The stablecoin bridge has since resumed routes that do not rely on liquidity pools but announced it plans to stop conducting pool-based swaps. The project also says it has traced $1.63 million of the stolen funds, which were bridged from Solana to a single Ethereum (ETH) consolidation address and then moved in several different directions.
Allbridge also notes that no user wallets, private keys or non-pool bridge routes were impacted by the exploit.
Follow us on X, Facebook and TelegramGenerated Image: Midjourney