Across Protocol (Solana relayer) incident, 2026-07-17
What happened to Across Protocol (Solana relayer)?
On 17 July 2026 an attacker forged 1,627 Solana deposit events into Across Protocol. A Risk Labs relayer that skipped Solana's 8-byte Anchor event check filled 581 of them, paying out about $4.5M of its own capital (net under $4M). No user funds were lost; Solana routes were paused for about 12 hours. The attacker later returned the remaining ≈ $3.7M in exchange for a 10% bounty.
Sources: The Cryptonomistcrypto.newsOAK (onchainattack.org)The Crypto Times
Key facts
- Date (UTC)
- Protocol
- Across Protocol — the Risk Labs-operated relayer filling Solana-origin intents
- Reported loss
- ≈ $4.5M gross paid out by the relayer (net under $4M after ≈ $500K of attacker funds were trapped); the attacker later returned the remaining ≈ $3.7M for a 10% bounty; user funds unaffected Across ProtocolThe Cryptonomistcrypto.newsOAK (onchainattack.org)DefiLlamaAcross ProtocolForesight News (via Bitget News)
- Root cause
- Off-chain software — the off-chain relayer did not check Solana's 8-byte Anchor event discriminator, so forged deposit events were treated as real OAK (onchainattack.org)The Cryptonomist
- Chains
- Solana, 18 destination chains
- Recovery
- Users made whole
- Official post-mortem
- Across Relayer Incident: Post-Mortem
Timeline
All dates and times in UTC.
- 2026-07-17 05:07 — First forged deposit submitted on Solana. The Cryptonomist
- 2026-07-17 06:14 — Forged deposit stream ends (1,627 deposits from single-use wallets, 18 destination chains, ≈ $41.7M face value); first attacker addresses blacklisted two minutes later. The Cryptonomist
- 2026-07-17 08:23 — Solana disabled as origin and destination chain in the Across API. The Cryptonomist
- 2026-07-17 08:35 — Solana SpokePool paused on-chain; first public statement one minute later. The Cryptonomist
- 2026-07-17 09:37 — Root-cause fix merged; deployed across all Risk Labs infrastructure at 10:26. The Cryptonomist
- 2026-07-17 17:05 — Solana deposits re-enabled via CCTP routing. The Cryptonomist
- 2026-07-24 — Across publishes its post-mortem on X; media report its figures. Across Protocol
- 2026-07-30 — Across says the attacker returned the remaining ≈ $3.7M after agreeing to a 10% bounty. Across Protocol
Where did the funds go, and was anything recovered?
The loss sat on the balance sheet of the relayer operated by Risk Labs, not on users: every genuine in-flight transfer was completed or refunded the same day (The Cryptonomist). About $500,000 of attacker funds were trapped inside the protocol, which brings the net loss below $4 million (crypto.news).
On 30 July 2026 Across said the attacker had made contact on 27 July and, after agreeing to a 10% bounty, returned the remaining funds (≈ $3.7M); Risk Labs' relayer capital was recovered less the bounty (Across on X; Foresight News via Bitget).
Which routes and bridges were affected?
Only routes with Solana as the origin chain were attackable, and only fills paid by the Risk Labs relayer. Across disabled Solana as origin and destination in its API, paused the Solana SpokePool, and re-enabled Solana deposits about 12 hours later via Circle CCTP routing. Routes between EVM chains were not affected.
Our reviews of the bridges involved: Across
Why did it happen?
Across is an intent bridge: a relayer pays the user on the destination chain first and is repaid later from the deposit locked on the source chain. That design makes the relayer's off-chain reading of "did a deposit really happen?" an authorisation decision. On Solana there is no canonical event log; consumers rebuild events from transaction data, and failed transactions can still emit bytes. Anchor prefixes each event with an 8-byte discriminator precisely so a reader can tell genuine events from look-alike data. The relayer code skipped that comparison, so crafted transactions that moved no tokens parsed as deposits (OAK).
Two things limited the damage. First, the loss landed on the party whose code failed: the relayer fronts its own capital, so users who bridged that day lost nothing. Second, a fallback path (CCTP) already existed, so Across could pause the vulnerable path without stranding Solana users. The weakness was in software nobody usually audits — off-chain observers — and the attack pattern (1,627 deposits fanned over 18 chains in about an hour) was far outside normal traffic, which suggests per-window fill limits would have capped the loss earlier.
What should users have done then, and what should they do now?
At the time
A user bridging from Solana that morning did not need to do anything: genuine deposits were filled or refunded. The practical step was to wait for the official all-clear rather than retrying transfers through other front-ends while Solana was disabled, and to keep the deposit transaction hash in case a refund needed to be claimed.
Now
The bug is fixed and Solana routes run again. For intent bridges in general: check who carries the loss if a filler is fooled (here, the relayer), whether the bridge has a pause and a fallback route, and how quickly it published a timeline. Prefer bridges that publish a dated post-mortem. On upswap, Across quotes are sampled like any other; the incident does not change the ranking, which is by net amount received.
Sources
7 independent publishers. Links checked on the date shown.
- Across Solana Relayer Attack Drained $4.5M — No User Lost a Cent — The Cryptonomist · Media · checked
- Across Protocol relayer loses under $4M in Solana attack — crypto.news · Media · checked
- Across Protocol — missing 8-byte Anchor discriminator check (2026-07-17) — OAK (onchainattack.org) · Security firm · checked
- Across Protocol Reports First Attack on Solana After $34B in Bridge Volume — The Crypto Times · Media · checked
- DefiLlama Hacks — Across, 2026-07-17 (Spoofed Event Log, $4.5M) — DefiLlama · Database · checked
- Across Relayer Incident: Post-Mortem — Across Protocol · Official · checked
- Update on the July 17 Relayer Incident: the funds are back — Across Protocol · Official · checked
- Across: The attacker has returned approximately $3.7 million, and the team has paid a 10% bounty — Foresight News (via Bitget News) · Media · checked
How do I cite this page?
Burn, A. / upswap.io (2026). Across Protocol (Solana relayer) incident (2026-07-17). Updated 2026-10-24. https://upswap.io/incidents/across-2026#summary. CC BY 4.0. Accessed ____.
Stable anchors: #summary #facts #timeline #funds #affected #analysis #then #now #sources #cite