Across Protocol — Solana Relayer Exploit (Risk Labs Capital Only, User Funds Safe)

Timeline: April 2026: Asymmetric Research discloses a vulnerability in the Across SVM spoke pool (event spoofing possible because Solana lacks a canonical event system and events are reconstructed from tx traces, with failed transactions still emitting data). Across patches the issue immediately — no funds lost, but the disclosure highlights that 'the trust boundary between Solana's on-chain state and the off-chain relayer software watching it is the most delicate seam in the system.' July 17, 2026 ~05:30 UTC: attack detected on Across Solana deployment. ~05:35 UTC: Solana deposits disabled as a precautionary measure. All in-flight bridge transactions were completed successfully for users. 11:36 AM UTC (July 17): Across posts official statement on X (tweet 2078036118209982566, 62.9K views): 'At ~5:30 AM UTC today, Across was attacked on Solana. User funds are safe. No users were affected, and all bridge transactions have been completed. Solana deposits have been disabled. The protocol is otherwise operating unaffected. The only funds potentially lost belong to the relayer operated by Risk Labs (the foundation supporting Across).' Follow-up ~11:05 UTC (July 17, 4:35 PM IST): 'your funds are safe and refunds will process automatically,' directing users to support.across.to, warning against phishing links. Across confirms cooperation with SEAL 911 to trace the 3 flagged addresses (1 Solana + 2 Ethereum). July 18, 2026: coverage by Crypto Times, Crypto Briefing, KuCoin, MarsBit, boerse-global.de. Crypto Times explicitly notes: 'Neither Across nor any independent investigator has published a dollar figure for the relayer's loss at the time of writing, and no attribution has been made.' Full post-mortem pending — Across states it will follow 'in the coming days.' Analysis question raised across coverage: was this the same class of issue as the April 2026 event handling bug, a flaw in the relayer bot infrastructure, or a compromised key? Only the post-mortem will confirm. Architecture context: Across V4 launched Solana support in July 2025 via SVM spoke pool on the Anchor framework. Intent-based model: relayers front their own capital on the destination chain to fill user transfers instantly, then are repaid via UMA optimistic oracle settlement. Users never hand custody to a pooled bridge contract — this design philosophy held here, users were not exposed. Track record before this incident: >$34-35B cumulative bridge volume with zero prior exploits since 2021 launch.