$1.65M Allbridge Hack: What Really Happened to the Bridge

On July 19, 2026, news broke that the Allbridge bridge had been exploited. The attacker withdrew about $1.65 million, but did not compromise any private keys or gain administrator access. The funds were taken using a flash loan from Kamino and a sequence of operations that distorted the pool's internal exchange rate. Within seconds, almost the entire amount returned to a linked Ethereum wallet and was then routed through several obfuscation schemes.

The Allbridge team paused the protocol and urged liquidity providers to withdraw their funds from the affected pools. BitOK analysts reconstructed the incident from its on-chain traces. Here is what really happened to Allbridge.

The attack targeted the Solana deployment of Allbridge Core. It took place overnight on July 19-20, 2026, and caused an estimated loss of approximately $1.65 million.

The entire scheme was executed in a single atomic transaction. The attacker borrowed funds from Kamino, ran a series of operations through the pool, and distorted the internal USDC/USDT exchange-rate calculation. Once the rate had been skewed, the protocol released significantly more assets than it should have. The loan was repaid within the same transaction, while the attacker kept the difference.

This is where the story becomes even more interesting. The attacker moved most of the proceeds to Ethereum and then converted them into ZEC through two independent routes: NEAR Intents and MAYAChain. Part of the funds remained in the Ethereum wallet.

Imagine an exchange booth where the rate automatically changes after every trade.

The attacker borrows money for a few seconds and repeatedly moves currency between two tills. These repeated trades distort the displayed exchange rate. The attacker then trades at the manipulated rate, withdraws more than was deposited, repays the loan, and keeps the difference.

No large amount of upfront capital is needed because most of the liquidity comes from a *flash loan.

*A flash loan is an uncollateralized loan that is taken out and repaid within a single blockchain transaction.
The logic is straightforward: until the transaction is complete, the network effectively pauses and checks whether the funds have been returned to the lender. If the loan and fee have not been repaid by the end of the transaction, the entire operation is automatically reversed as though it never happened, and the lender loses nothing.

This is why no collateral is required: the inability to walk away without repaying the funds is built into the mechanism itself. A borrower can access millions without using any of their own capital, provided the full amount is returned in the same transaction.

Flash loans are normally used for legitimate activities such as arbitrage or refinancing. However, instant liquidity also makes them an ideal attack tool: an attacker borrows a large amount, uses it to distort the price in a vulnerable pool within fractions of a second - as happened with Allbridge Core - captures the profit, and repays the loan, all in one transaction.

The most revealing part of this story is not the manipulation itself, but what happened beforehand.

The attacker's main Ethereum wallet was 0x651591b68A9c9650FB23F642162353306281ffDe. Before the attack, it sent approximately 0.0121 ETH through Mayan Swift. On Solana, the process ended with roughly 0.2969721 SOL arriving at the wallet that later executed the exploit. Mayan Swift converts the incoming ETH into SOL and delivers it to a wallet on another network, while solvers compete for the right to execute the swap.

Key addresses and transactions at this stage:

Attack transaction: 3LNLaGi36bqoSBFBqcQ3ZvDbnGCxrxu4rqahZrnfHZjKSYxfR1mqiCXtBXjjeBmoRQDeSiKxZ7c1nFb8pBgTY39Q

Everything happened in a single atomic transaction. The attacker took out a Kamino flash loan of approximately 1.122 million USDC, routed several operations through Allbridge Core, distorted the pool's virtual balance and internal pricing, withdrew an inflated amount of assets, repaid the flash loan, and kept the resulting difference.

A public technical analysis also points to a Kamino flash loan and manipulation of the pool's USDC/USDT liquidity ratio.

Investigator's note: no private key or administrator access was compromised. The weakness was embedded in the pool's formula itself.

How the attacker moved the funds. The graph was built using BitOK's Graph tool.

Immediately after the exploit, the funds began to be converted into assets suitable for transfer to another network. Several solvers appeared in the transaction chain:

Ultimately, the activity resulted in three major cross-chain transfers: USDT to ETH, USDC to ETH, and USDC to DAI.

Investigator's note: SolFi and BitcoinVN should be viewed here as routing components and liquidity sources, not as mixers deliberately selected by the attacker for laundering.

The stolen funds were transferred through Mayan MCTP to the Ethereum wallet 0x651591b68A9c9650FB23F642162353306281ffDe. Under the hood, Mayan MCTP uses Circle CCTP to move value between networks and Wormhole messages to coordinate and verify execution.

The wallet received the following amounts in three main transactions:

From that point on, 0x6515...ffDe became the central Ethereum hub for the rest of the scheme.

The attacker sent part of the DAI to the intermediary Ethereum address 0x97bc883ff48b0a40ee55dc5a9ff731f18b52ea2d, which then deposited approximately 307,000 DAI into Railgun.

The route formed a loop: from 0x6515...ffDe to 0x97bc...ea2d, then into Railgun, back to 0x97bc...ea2d, and finally to 0x6515...ffDe again. Several hours later, approximately 306,200 DAI left Railgun and returned to the main wallet through the same intermediary address.

Investigator's note: Railgun was not the final destination here, but an obfuscation loop. The funds entered a private pool, remained there for several hours, were withdrawn, and then returned to the same controlled address cluster. Part of the transaction history remained hidden inside Railgun.

As soon as part of the DAI returned from Railgun, the attacker began converting funds into Zcash through NEAR Intents. Three transactions have been confirmed:

This route generated a total of 1,116.9381 ZEC.

NEAR Intents works like an order marketplace: the user specifies the desired output, and third-party solvers compete to execute the swap.

An additional 100 ETH was also sent through NEAR Intents. However, the available data does not show how that transaction concluded or which address received the funds, so it is not included in the confirmed ZEC total.

Investigator's note: at the current level of NEAR Intents support, Zcash transactions work only with transparent t1 and t3 addresses. Converting funds into ZEC therefore does not make them invisible by itself - true privacy begins only once the funds enter a shielded pool.

The second major route went through MAYAChain, where the attacker acted more cautiously. Instead of swapping the entire amount at once, the attacker split the ETH across numerous transactions. MAYAChain often executed only part of each swap and returned the unused ETH to the source wallet.

The final figures were as follows:

All confirmed MAYAChain outputs were sent to the transparent Zcash address t1KHDfWNpTQZjiipfW8z36QmdkaWL87zsBq and originated from t1RBkNhHAwZcrhN3YmJ9wS8eCcAVWFQg7oh. Only two small transactions left the main address: 0.034322 ZEC to t1bDsTZ4UT3LH1SkethFzzeAckQeaA7v7t7 and 0.945088 ZEC to t1Wb1S2ezx7Hj64PumFz6eo2ZFSNscUPvMf. At the time of the data export, the address still held 929.48219016 ZEC.

Investigator's note: t1RBk...g7oh is part of MAYAChain's own outbound infrastructure and should not be labeled as the attacker's wallet. For now, this route remains transparent: most of the ZEC is held at a publicly visible t1 address.

The attacker moved most of the proceeds into Zcash through two parallel routes. Based on confirmed data, the picture is as follows:

This was not the protocol's first incident. In April 2023, Allbridge was exploited for $573,000, also through a flash loan, this time against a pool on BNB Chain. The attacker acted as both a liquidity provider and a swapper, exploiting a smart-contract flaw that allowed swap prices to be manipulated. The pool lost $289,900 in BUSD and $290,900 in USDT.

The latest Allbridge Core incident was at least the sixth attack on a cross-chain bridge since May.

Bridges are attractive targets for attackers because they hold large pools backing assets on destination networks. Other projects targeted during this period included:

On Sunday, the team announced that it was pausing the protocol and asked liquidity providers to withdraw their funds from the affected pools. Allbridge also appealed to users who had profited from the distorted exchange rate: the pool imbalance briefly created an arbitrage opportunity, and any returned funds would be used directly to compensate affected *LPs.

*Liquidity providers (LPs) are users who deposit their own assets - stablecoins in the case of Allbridge Core - into a bridge pool so the protocol can execute swaps and cross-chain transfers.

The attack was prepared in advance. First, an Ethereum wallet funded a Solana wallet with gas through Mayan Swift. The Solana wallet then borrowed funds from Kamino and distorted Allbridge Core's internal balance. Immediately after the theft, the proceeds returned to the linked Ethereum wallet through Mayan MCTP.

On Ethereum, the funds split across several routes:

Most of the proceeds ultimately ended up in ZEC. However, the receiving addresses are still transparent Zcash addresses, meaning the funds can be tracked until they potentially enter a *shielded pool. Approximately $300,000 also remains in the attacker's main Ethereum wallet.

*A shielded pool is the private, protected part of the Zcash network.