Across Reveals Sub-$4 Million Net Loss From Solana Relayer Exploit

On July 17, 2026, an attacker exploited Across Protocol's Risk Labs-operated relayer, forging 1,627 Solana deposits worth $41.7 million. The exploit succeeded due to a missing 8-byte Anchor event discriminator check in the off-chain software. The relayer paid out $4.5 million before suspending services, but trapped attacker funds kept the net loss under $4 million. Because of Across's intents-based design, user funds were completely unaffected, and service was restored within 12 hours via Circle's CCTP.

Solana relayer exploit

• ▪An attacker targeted Across Protocol's Risk Labs-operated relayer on July 17, 2026, exploiting a vulnerability to forge Solana deposit events.
• ▪The Across Protocol exploit did not compromise the Solana network, the protocol's smart contracts, or user funds.

Missing discriminator check

• ▪The attacker used a wrapper program to CPI into a read-only SpokePool helper function, get_unsafe_deposit_id, to append forged FundsDeposited payloads.
• ▪The attacker used 1,627 single-use Solana wallets to submit 1,627 forged deposits requesting payments across 18 destination chains.

Forged deposit scale

• ▪The attacker used 1,627 single-use Solana wallets to submit 1,627 forged deposits requesting payments across 18 destination chains.
• ▪The forged Solana deposits carried a combined face value of approximately $41.7 million, directed toward a single recipient address on an Ethereum Virtual Machine-compatible network.

Relayer capital loss

• ▪Across Protocol's net loss was kept under $4 million because approximately $500,000 of the attacker's funds remained trapped within the protocol.
• ▪The Risk Labs relayer filled 581 of the fraudulent requests, advancing approximately $4.5 million of its own capital before Across suspended Solana operations.

Incident response timeline

• ▪Across Protocol restored Solana transfers in approximately 12 hours by routing transactions through Circle's Cross-Chain Transfer Protocol.
• ▪The attack began at 05:07 UTC on July 17, 2026, and Risk Labs engineers merged a root-cause fix at 09:37 UTC and deployed it by 10:26 UTC.

Intents protocol design

• ▪Because of Across Protocol's intents-based design, the forged deposits never touched user escrow, leaving Risk Labs' relayer capital to absorb the loss.
• ▪Across Protocol operates as an intents protocol where independent relayers advance their own capital to fulfill transfers before claiming repayment.

3 sources