Across, Allbridge, TeleSwap lost $5.7M to bridge hacks in past week

The crypto sector continues to experience costly exploits on a near daily basis. In the past week alone, three blockchain bridges have been attacked, with an estimated total of over $5.7 million stolen.

The projects, Allswap, Across Protocol, and TeleSwap appear to have lost $1.65 million, $3.35 million and $735,000, respectively.

The sums lost this week may not be comparable to larger hacks during the first months of the year, but nevertheless show the continued vulnerability of blockchain bridges.

So far this year, Protos has tallied 20 bridge hacks, with a total of over $355 million lost.

Across Protocol

On Friday, Across Protocol disclosed an attack on Solana, advising users it had paused deposits on the affected blockchain.

The post reassured users that any lost funds “belong to the relayer operated by Risk Labs (the foundation supporting Across),” but didn’t state how much was stolen.

Examination of the two EVM addresses (1, 2) flagged by Across found inflows totalling $3.35 million on the morning of the exploit.

The majority of funds have since been consolidated to another address, which currently holds 1,500 ETH ($2.85 million).

The attacker’s addresses were funded via privacy protocol Tornado Cash (on Ethereum) and no-KYC exchange FixedFloat (on Solana). Both are funding sources often favoured by illicit actors.

It remains unclear exactly what caused the hack, though Across said it would publish a “full technical post mortem next week.”

Allbridge

Late on Sunday, Allbridge was struck by a flash loan-powered exploit, also on Solana.

The price manipulation attack targeted one of Allbridge’s liquidity pools, draining $1.66 million in stablecoins USDC and USDT.

In the firm’s initial alert warning of the attack, Allbridge asked any users who had profited off the “temporary positive arbitrage window” the attack caused to “consider returning funds,” which would be put towards compensation efforts.

TeleSwap

Finally, on Monday, pseudonymous blockchain investigator ZachXBT revealed that the self-styled “Bitcoin DeFi hub” TeleSwap had been exploited the previous week, on July 15.

The sleuth called out the firm for “not disclos[ing] the incident publicly after five days.”

He claims to have tracked suspicious outflows of over $735,000 and that TeleSwap’s “Bitcoin hot wallet stopped processing transactions” shortly afterward.

At the time of writing, TeleSwap is still to disclose the loss on its official X account.