Cross-chain bridge project Allbridge was attacked on Aug. 19, 2026, losing about $190,000, according to disclosures from blockchain security firm SlowMist.
SlowMist said the exploit was staged over nearly a month rather than carried out instantly, with the attacker using a forged cross-chain message to get around verification checks.
The setup began on July 26 on Polygon
According to SlowMist’s analysis, the attacker directly called Circle’s MessageTransmitterV2.sendMessage function on Polygon on July 26 and built a cross-chain message designed to look like a CCTP-style transfer. The message claimed that 1 million USDC had been transferred, but no USDC burn actually occurred.
Circle then generated a valid attestation for the complete message through its standard process.
The attack came 24 days later, six seconds after a real deposit
About 24 days later, on Aug. 19, the attacker waited until the Base Router received a real CCTP deposit and its balance increased to about 191,000 USDC. Six seconds later, the attacker launched the exploit.
Using the previously forged message and the attestation, the attacker called Allbridge’s receiveCctpMessage function. SlowMist said missing checks in the protocol caused the system to treat the fake cross-chain message as a real deposit and record a 1 million USDC amount.
Flash loan used to match the forged amount
The attacker then temporarily borrowed about 809,000 USDC through an Aave flash loan to make the Router balance match the forged amount. With that balance in place, the attacker used the protocol’s internal credit record to call the transfer function and moved out about 999,000 USDC after a 0.1% fee deduction.
After repaying the flash loan and associated fees, the attacker’s net profit was about $189,800.
SlowMist points to missing validation steps
SlowMist said the root cause was that Allbridge did not verify the identities of the cross-chain message sender and recipient. It also did not confirm whether USDC had actually been minted or whether the balance had truly increased, instead trusting the amount and message hash data supplied by the attacker.
The firm said on-chain message verification is not the same as confirming that assets have actually arrived. For cross-chain protocols, message authenticity checks alone are not enough. They also need to verify that the message source is trusted, that the recipient is Circle’s official TokenMessengerV2, and that asset minting and balance changes have actually occurred before crediting funds.
The incident highlights the security risks that remain in message verification and asset settlement for cross-chain bridges.