Across Protocol Suffers Sub-$4M Loss in Solana Attack

Overview of the Incident

Across Protocol’s relayer incurred a loss of less than $4 million following a cyber attack that involved the fabrication of deposits on the Solana blockchain. An official report from the cross-chain protocol indicated that the attack, which occurred on July 17, resulted in the creation of 1,627 fake deposits valued at approximately $41.7 million.

Details of the Attack

The attack unfolded over a 67-minute period, during which the perpetrator utilized 1,627 single-use Solana wallets to submit fake deposits across 18 different chains. Ultimately, the relayer processed 581 fraudulent requests, amounting to approximately $4.5 million. However, the total attempted deposit value was around 10.8% of the overall face value.

Risk Labs, which operates the relayer, halted operations before processing the remaining 1,046 requests, thereby preventing further losses. The protocol was able to invalidate about $37 million in unpaid fake deposits as a precautionary measure.

Identifying the Root Cause

The breach was linked to a bug within Risk Labs’ relayer codebase, rather than a flaw in Across Protocol’s smart contracts. The report clarified that the attack exploited the off-chain event-reading software used by the relayer, without affecting the underlying Solana network or its on-chain contracts.

User Impact and Response

Across Protocol affirmed that no users lost funds during the incident. All legitimate transfers were either completed or refunded on the same day of the attack, underscoring the protocol’s robustness. Across had facilitated over $34 billion in bridge volume while maintaining user fund security.

Future Actions and Recovery Plans

Following the incident, Across deployed a fix roughly five hours after the attack and resumed Solana services via Circle’s Cross-Chain Transfer Protocol about 12 hours later. This new system employs a burn-and-mint process for transferring native USDC across compatible networks.

The protocol is closely monitoring the situation involving the attacker’s linked funds but has not disclosed a recovery agreement, arrest, or further details regarding the attacker’s identity.

Market Impact

At the time of reporting, ACX was trading at approximately $0.041, reflecting a 2.8% decline over 24 hours. Despite the attack, the protocol reiterated that the relayer’s loss would not disrupt ongoing plans for ACX token buybacks. The token’s market cap was around $29.1 million.