Allbridge
Hack or exploit on Aug 19, 2026 · Bridge Logic Flaw
What happened
Allbridge’s CCTPTokenMessenger treated a valid Circle-attested message as proof that USDC had actually been transferred. An attacker created an arbitrary CCTP message on Polygon declaring a 1,000,000 USDC transfer without burning any USDC and directed its recipient to an attacker-controlled contract rather than Circle’s TokenMessengerV2. Circle legitimately attested the generic message, but redeeming it on Base minted no USDC. Allbridge nevertheless trusted the attacker-controlled amount encoded in the message and recorded a 1,000,000 USDC deposit without checking for a corresponding token balance increase. The attacker flash-loaned 808,844 USDC to temporarily bring the router’s balance to the declared amount, redeemed the phantom credit for 999,000 USDC, repaid the loan, and drained the router’s existing liquidity. A copycat subsequently used the same technique to take the remaining funds
Details
- Date
- Aug 19, 2026
- Kind
- Hack or exploit
- Method
- Bridge Logic Flaw
- How in
- Bridge and cross-chain
- Target
- DeFi protocol
- Chains
- Base
Reported by
Related incidents
Allbridge Core 2023 · Hack or exploit · $572K
THORChain DEX 2026 · Hack or exploit · $10.7M
NEAR Intents 2026 · Hack or exploit · $3.8M
Harmony Bridge 2026 · Hack or exploit · $3.2M
SwanBluechip, "Allbridge hack, Aug 19, 2026: $190K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht91b63cd90c/ (data as of 2026-10-31).