Incident Overview
On July 17, 2026, cross-chain intents protocol Across Protocol suffered a security incident targeting Risk Labs' off-chain Solana relayer event-parsing infrastructure. An attacker forged fake deposit events on Solana, tricking the relayer into fronting approximately $4.5 million of its own capital across destination chains before operations were halted. No user funds were lost, and $3.7 million was subsequently recovered on July 27 following a 10% white-hat bounty agreement.
The incident was caused by a software logic bug in Risk Labs' off-chain event listener (SvmCpiEventsClient) rather than an on-chain smart contract vulnerability. The off-chain relayer software parsed inner instruction CPI events routed through the Solana SpokePool's __event_authority PDA, but failed to verify the required 8-byte Anchor event discriminator that validates genuine event CPIs.
Taking advantage of this missing validation check, the attacker deployed a wrapper program that executed CPIs into a read-only SpokePool instruction (get_unsafe_deposit_id) while attaching forged FundsDeposited event payloads. While no state changed and no funds moved on-chain, the off-chain relayer misidentified these transactions as real deposits. The attacker submitted 1,627 forged deposit payloads (~$41.7 million face value) across 18 destination chains. The relayer filled 581 of these fake requests, paying out ~$4.5 million of its own capital before the team disabled Solana routing. Because Across operates as an intent-based architecture where relayers front liquidity prior to settlement verification, relayer capital absorbed the entire loss and zero user funds were impacted.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Across, these are the critical security checks that could have prevented this incident (July 2026).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialFunds Recovery
Recovered
$3.7M
Net Loss
800999
Post-Incident Timeline
-
2026-07-31
Amount Lost: ~$4.5 million initial relayer payout ($0 user funds lost; ~$3.7 million recovered after 10% bounty) Status: Off-chain event parsing code patched; Solana order flow temporarily routed through CCTP fallback; relayer funds recovered less the white-hat bounty.
Sources & References
Learn to Prevent the Next Across
The Across hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.