OAK — OnChain Attack Knowledge

Worked example · 2026-07

Allbridge Core — a $1.12M Kamino flash loan skews the USDC/USDT pool ratio, liquidity is withdrawn at the distorted valuation, and the loan repays in the same transaction — Allbridge Core (Solana) — 2026-07-19

Loss
~$1.65M from Allbridge Core's Solana deployment, of which roughly $1.1M was extracted directly by the attacker inside the manipulating transaction; the remainder is attributable to the arbitrage window the manipulation opened for third parties. Proceeds were bridged to Ethereum and routed through privacy pools. This is Allbridge's second flash-loan exploit — the first took $573,000 in April 2023.
OAK Techniques observed
OAK-T9.002 (Flash-Loan-Enabled Exploit — primary, confirmed mechanism. The attacker borrowed $1.12M USDC via a flash loan from Kamino, the Solana lending protocol, used it to execute a series of rapid swaps that distorted the ratios of Allbridge's USDC/USDT stablecoin pool, withdrew liquidity at the resulting inflated valuation, and repaid the flash loan within the same transaction. The flash loan is not incidental here — it supplies the capital that makes a pool of this size movable within one atomic transaction, and returns it before the block closes. See techniques/T9.002-flash-loan-enabled-exploit.md). OAK-T9.001 (Oracle Price Manipulation — cross-referenced for the pricing dimension: the pool's own reserve ratio is the price used to value a liquidity withdrawal, so distorting the ratio and then redeeming against it is the AMM-internal form of feeding a protocol a price it should not have believed). OAK-T7.003 (Cross-Chain Bridge Laundering — Solana → Ethereum) and OAK-T7.001 (Mixer-Routed Hop — the routing through privacy pools).
Attribution
pseudonymous. No named individual or group, and no public link to a tracked OAK actor. The proceeds were bridged from Solana to Ethereum and laundered through privacy pools. Distinctly from the attacker, third-party traders profited from the pricing distortion the manipulation left behind; Allbridge publicly asked those traders to return funds for liquidity-provider compensation. Per OAK's neutral-disposition convention, arbitrageurs capturing a price dislocation are not classified as participants in the attack — but the funds they captured are part of the pool's realised loss, which is why the headline figure exceeds the attacker's direct extraction.
Key teaching point
In a stablecoin pool, the reserve ratio is simultaneously the invariant and the price — and a flash loan turns any pool small enough to move into a pool priced by whoever is willing to move it. No key was compromised and no signature was forged; the attacker paid the swap fees, took the slippage, and redeemed liquidity at a valuation the pool computed correctly from state the attacker had just authored. The controls that close this are pool-design controls rather than access controls: redemption pricing that references a time-weighted or externally-anchored rate rather than the instantaneous reserve ratio, per-transaction caps on liquidity withdrawal as a share of reserves, and flash-loan-aware guards that decline to honour a withdrawal in the same transaction as a large ratio change. The second, sharper lesson is in the aftermath: the manipulation left the pool imbalanced, which created a positive arbitrage window for uninvolved traders, so the liquidity providers' loss exceeded the attacker's gain. Any accounting that measures this incident by what the attacker took understates what the LPs lost.

Summary

Allbridge Core is a cross-chain stablecoin bridge whose liquidity sits in per-chain pools. Its Solana deployment held a USDC/USDT pool.

On 2026-07-19, an attacker took a flash loan of $1.12M USDC from Kamino, a Solana lending protocol. Within the same transaction, they executed a series of rapid swaps that pushed the USDC/USDT pool's reserve ratio far from its balanced state, then withdrew liquidity while that distorted ratio governed the redemption valuation, and repaid the flash loan — netting roughly $1.1M.

The manipulation left the pools imbalanced. That imbalance constituted a temporary positive arbitrage opportunity, which third-party traders took. Total losses reached approximately $1.65M. Allbridge subsequently asked traders who had profited from the pricing distortion to return funds for LP compensation.

Allbridge paused the protocol while investigating and advised liquidity providers to withdraw from affected pools. The attacker's proceeds were bridged to Ethereum and laundered through privacy pools.

Allbridge had been exploited by a flash-loan attack once before, losing $573,000 in April 2023.

Timeline (UTC)

When Event OAK ref
2023-04 Prior flash-loan exploit takes $573,000 from Allbridge (prior incident, same class)
(standing) Allbridge Core's Solana USDC/USDT pool prices liquidity redemption against the instantaneous reserve ratio, with no withdrawal cap or flash-loan-aware guard (standing T9.002 surface)
2026-07-19 Attacker borrows $1.12M USDC from Kamino via flash loan T9.002 setup
same transaction Rapid swaps distort the USDC/USDT pool ratio; liquidity withdrawn at the inflated valuation; flash loan repaid; ~$1.1M extracted T9.002 / T9.001 exploitation
after Residual pool imbalance opens an arbitrage window; third-party traders capture the dislocation; total loss reaches ~$1.65M (secondary LP loss)
2026-07-19/20 Allbridge pauses the protocol, advises LPs to withdraw from affected pools, and asks profiting traders to return funds for LP compensation (operator response)
after Proceeds bridged Solana → Ethereum and routed through privacy pools T7.003 / T7.001

What defenders observed

  • Pre-event (redemption priced off instantaneous state). The single load-bearing design choice. If a liquidity withdrawal is valued using the reserve ratio as it stands at that instant, then anyone who can move the ratio can choose the valuation. Anchoring redemption to a time-weighted rate, or to an external reference for assets that are supposed to trade at parity, removes the attacker's control over the price they redeem at (M09, M17).
  • Pre-event (pool size relative to available flash liquidity). The relevant risk metric is not the pool's absolute size but its size against the capital an attacker can borrow for one transaction at no credit risk. With Kamino supplying $1.12M on demand, a pool that a $1.12M swap can meaningfully skew is a pool that is priced by whoever chooses to skew it. Every pool operator can compute this ratio in advance.
  • Pre-event (no withdrawal cap). A per-transaction bound on liquidity redeemable as a share of reserves would have limited extraction regardless of how the ratio was manipulated, and would have cost normal LPs nothing (M04).
  • At-event (ratio change and redemption in one transaction). The atomic signature — large swap, large withdrawal, flash-loan repayment, all in a single transaction — is the canonical flash-loan-exploit shape and is detectable by any simulation-based monitor. A guard declining redemptions that occur in the same transaction as a ratio change beyond a threshold is a direct, mechanical mitigation (M04, M05).
  • Post-event (the arbitrage tail is part of the loss). Roughly a third of the total came out of the pool after the attacking transaction, through ordinary traders correcting a dislocation. Operators should model the residual imbalance as part of an exploit's cost and prioritise rebalancing or pausing the pool immediately, because every minute the dislocation persists transfers more LP value to uninvolved parties who have committed no wrongdoing and have no obligation to return it.
  • Response (a request, not a claim). Allbridge asked arbitrageurs to return profits for LP compensation. That is the only lever available, since capturing a public price dislocation is normal market activity. It underlines that the remedy has to be preventive: once the imbalance is public, the value is gone through legitimate channels.

Public references

Discussion

Allbridge is the July cohort's reminder that the 2020-era exploit classes have not been engineered out — they have merely stopped being the largest line items. Most of July 2026's losses came from keys, upgrade authorities, and off-chain observers; this one is a textbook flash-loan pool manipulation of the kind OAK documents from 2021, executed on Solana in 2026 against a bridge that had already been hit by the same class in April 2023. A defender reading only the year's headline trend — "attackers have moved from code to keys and people" — would under-weight a mechanism that is still live and still profitable at seven figures.

The repeat is worth handling carefully, and it contrasts instructively with examples/2026-07-verus-ethereum-bridge-repeat-exploit-unfixed-import-path.md from four days later. Verus was re-exploited 66 days after a published root cause, on the identical contract, through the identical entry path — a remediation failure with a specific unfixed predicate. Allbridge's recurrence is a different animal: more than three years later, on a different chain deployment, through the same class rather than the same defect. That distinction should be preserved rather than collapsed into "hit twice," because it points at different remedies. Verus needed to ship a patch it already knew it needed; Allbridge needed a pool-pricing architecture that does not price redemptions off instantaneous reserves — a design commitment, not a bug fix.

The arbitrage tail is the detail most likely to be lost in summary reporting and the one contributors should record deliberately. Roughly $550K of the $1.65M left the pool through traders doing something entirely ordinary. OAK's convention keeps them out of the attacker column, which is correct, but the LP accounting has to include them — otherwise the corpus systematically understates the cost of pool manipulation by whatever the dislocation tail happens to be. Future examples in this class should record attacker extraction and residual dislocation loss as separate figures wherever reporting allows.

Techniques demonstrated (4)