Allbridge's CCTP router on Base exploited for $191K via forged Circle message validation, with attacker timing attack 6 seconds after legitimate transfer.
Security & Exploits ·
An exploit on Allbridge's Cross-Chain Transfer Protocol (CCTP) router on Base drained 191,156 USDC on August 19, 2026. The attacker exploited a validation flaw by redeeming a forged Circle message that claimed a 1,000,000 USDC deposit without any actual token transfer occurring. The router credited the amount written inside the message as a spendable deposit without verifying that USDC had been minted to the bridge.
The attack involved a two-stage strategy: the attacker created the fraudulent message 24 days prior on Polygon and allowed it to sit attested. When the router held sufficient liquidity, they executed the exploit by flash-loaning 808,844 USDC from Aave to cover the shortfall between what the router held and the claimed deposit amount. The strike occurred six seconds after a legitimate 191,112 USDC transfer arrived, allowing the attacker to withdraw funds before the bridge's relayer could process the legitimate deposit.
The vulnerability lies in a missing balance check in the receiveCctpMessage function. The contract verifies the message's cryptographic authenticity with Circle but does not confirm that a corresponding token mint occurred. Additionally, the sourceSender field—meant to validate the message origin—is read directly from the attacker-controlled message body, enabling spoofing of the remote token messenger address.