Across Protocol's Relayer Loses Nearly $4 Million in Solana Deposit Fraud

Across Protocol’s relayer, operated by Risk Labs, suffered a loss just under $4 million after an attacker fabricated fake deposit events on Solana, as detailed in the protocol’s incident report. The attacker generated 1,627 counterfeit deposit records valued at around $41.7 million, targeting 18 different blockchains during the July 17 attack.

The breach took place within a tight 67-minute window, from 05:07 to 06:14 UTC. Using single-use wallets on Solana, the attacker created thousands of fake deposits that funneled payments ultimately to one recipient on an Ethereum Virtual Machine-compatible chain.

Risk Labs' relayer processed 581 fraudulent requests, paying out roughly $4.5 million before the service was suspended. This payout represented just 10.8% of the total attempted deposit value. Around $500,000 of the attacker’s funds remained locked inside the protocol, which helped reduce the net loss below $4 million. The protocol halted Solana transfers through its Cross-Chain Transfer Protocol (CCTP) to prevent further damage, invalidating roughly $37 million in unpaid fake deposits.

Across Protocol attributed the incident to a bug in Risk Labs’ off-chain event-reading software, rather than a flaw in its on-chain smart contracts or Solana’s network. This meant the attacker never compromised the protocol’s core contracts or the underlying blockchain, which helped protect user funds.

Thanks to an operational design where relayers front their own capital to process cross-chain orders before seeking reimbursement, users were shielded from immediate losses. Across confirmed that all legitimate transfers on the day of the attack were either completed or fully refunded. According to the protocol, it has handled over $34 billion in bridge volume without losing user assets to date.

This incident stands apart from other recent attacks, like the one on Lien Finance. Across’s quick suspension of the compromised service and trapped attacker funds limited the financial impact to Risk Labs’ relayer. Market impact remains to be seen.