🚨 On August 19, 2026, the well-known cross-chain bridge @Allbridge_io was attacked, resulting in a loss of approximately $190,000. However, the attack itself took nearly a month to complete. The SlowMist Security Team has fully analyzed the incident. 🧩 Attack flow: 1️⃣ On July 26, the attacker directly called Circle’s MessageTransmitterV2.sendMessage on Polygon to construct a forged CCTP-style message claiming a 1,000,000 USDC transfer (no actual USDC burn occurred). Circle subsequently issued a valid attestation for the complete message, as expected. 2️⃣ After waiting ~24 days, on August 19 the attacker struck just 6 seconds after a genuine CCTP deposit caused ~191k USDC to be minted to the Base Router, bringing its balance to ~191,156 USDC. 3️⃣ The attack contract called Allbridge’s receiveCctpMessage with the forged message + attestation. Missing checks allowed the forged message to be treated as a genuine deposit and 1M USDC to be credited without actual minting. 4️⃣ An Aave flash loan temporarily topped up the Router with 808,844 USDC, bringing its balance in line with the forged amount. 5️⃣ Router.receiveToken trusted the internal credit record and transferred ~999,000 USDC (after a 0.1% fee) to the attacker. 6️⃣ The attacker repaid the flash loan + fee, leaving a net profit of ~$189,751. Most of the drained funds came from genuine cross-chain deposits that had just arrived and had not yet been transferred to users. ⚙️ Root Cause: Missing checks on the message sender (must be the remote TokenMessenger) and recipient (must be Circle TokenMessengerV2). Allbridge trusted the attacker-crafted amount and messageHash in hookData without verifying actual USDC minting or a corresponding balance increase. Circle attestation ≠ real asset movement. 🔒 SlowMist Insight: Authenticated messages are necessary, but actual asset receipt is the basis for payment. Enforce trusted sender, recipient = TokenMessengerV2, and credit only after confirmed minting and balance increase. Full analysis👇 https://slowmist.medium.com/a-cross-chain-attack-spanning-one-month-analysis-of-the-allbridge-hack-32a6183bce08?postPublishedType=initial(SlowMist)