Allbridge Core Hack

TOTAL LOST $650K
Low Flash Loan Attacks bsc

What happened

During the night of 1–2 April 2023, an attacker used flash-borrowed capital to exploit Allbridge Core’s BNB Chain BUSD and USDT liquidity pools. The pools paired real stablecoins with internal vUSD balances. By pushing those balances far out of alignment, then withdrawing and swapping through the distorted pools, the attacker extracted value that the old withdrawal accounting did not price correctly.

Allbridge’s later retrospective estimates about $650,000 lost across the attack series. This was an internal liquidity-pool accounting and swap-logic flaw, not an external oracle compromise.

Technical Root Cause

Allbridge Core’s old withdrawal accounting assumed equal vUSD mint and burn amounts remained economically valid under extreme pool imbalance. An attacker could compose deposits, cross-pool swaps, and withdrawals to make a pool increasingly distorted and then receive an outsized payout from its internally calculated exchange value.

Case & protocol details

Classification Ecosystem / Bridge / Protocol Logic
Protocol Type Bridge
Affected asset / contract ABR
Official Website allbridge.io/
Protocol Twitter/X @Allbridge_io
Attacker Address 0xC578d755Cd56255d3fF6E92E1B6371bA945e3984
Exploit Transaction 0x7ff1364c3b3b296b41…4f1aef8210

Attack Timeline

The attacker flash-borrowed roughly $5 million BUSD and $2 million USDT, becoming a major liquidity provider in both pools. They moved about $500,000 of internal value from the USDT side to the BUSD side, then withdrew most of the BUSD liquidity. Under the old one-for-one vUSD mint-and-burn assumption, that withdrawal made the BUSD pool severely imbalanced.

A comparatively small reverse swap was then credited with an outsized amount of vUSD value, creating the profitable leg. The attacker withdrew remaining liquidity, repaid the flash loan, and retained the surplus; a second, smaller attack occurred before the on-chain mitigation stopped the vector.

Security review history

Funds Recovery

71.5%

Recovered

$465K

Net Loss

$185,250

Post-Incident Timeline

  • 2023-04-03

    1500 BNB were returned by the exploiter.

Evidence & learning

Attack pattern

Compare incidents →
Flash Loan Attacks Oracle Manipulation & Price Manipulation

Proof of concept

1 available

Sources and on-chain records

Practice this exploit pattern safely

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes