Allbridge Core Hack

Reported loss $650K
BNB Chain
Flash-loan-funded pool accounting and swap-logic flaw

What happened

During the night of 1–2 April 2023, an attacker used flash-borrowed capital to exploit Allbridge Core’s BNB Chain BUSD and USDT liquidity pools. The pools paired real stablecoins with internal vUSD balances. By pushing those balances far out of alignment, then withdrawing and swapping through the distorted pools, the attacker extracted value that the old withdrawal accounting did not price correctly.

Allbridge’s later retrospective estimates about $650,000 lost across the attack series. This was an internal liquidity-pool accounting and swap-logic flaw, not an external oracle compromise.

Technical root cause

Allbridge Core’s old withdrawal accounting assumed equal vUSD mint and burn amounts remained economically valid under extreme pool imbalance. An attacker could compose deposits, cross-pool swaps, and withdrawals to make a pool increasingly distorted and then receive an outsized payout from its internally calculated exchange value.

How it happened

  1. The attacker flash-borrowed roughly $5 million BUSD and $2 million USDT, becoming a major liquidity provider in both pools.
  2. They moved about $500,000 of internal value from the USDT side to the BUSD side, then withdrew most of the BUSD liquidity.
  3. Under the old one-for-one vUSD mint-and-burn assumption, that withdrawal made the BUSD pool severely imbalanced.
  4. A comparatively small reverse swap was then credited with an outsized amount of vUSD value, creating the profitable leg.
  5. The attacker withdrew remaining liquidity, repaid the flash loan, and retained the surplus; a second, smaller attack occurred before the on-chain mitigation stopped the vector.

Protocol details

Classification Ecosystem / Bridge / Protocol Logic
Protocol Type Bridge
Category Bridge Hack
Affected asset / contract ABR
Protocol links Website @Allbridge_io
Attacker Address 0xC578d755Cd56255d3fF6E92E1B6371bA945e3984
Exploit Transaction 0x7ff1364c3b3b296b41…4f1aef8210

Security review history

Funds Recovery

71.5%

Recovered

$465K

Net Loss

$185,250

Post-Incident Timeline

  • 2023-04-03

    1500 BNB were returned by the exploiter.

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Flash Loan Attacks Oracle Manipulation & Price Manipulation

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes