Across Protocol's Solana bridge was attacked this morning. Risk Labs absorbed the loss so users didn't have to.
Across Protocol's relayer model just ran its first real-world stress test. Risk Labs absorbed the loss so user deposits never touched the vulnerable contract.
CryptoVibe Desk · across-protocol · solana · bridge
- →Across Protocol confirmed an attack on its Solana bridge on July 17, detected around 5:30 AM UTC, with Solana deposits immediately disabled.
- →Because Across uses relayers who front orders with their own capital, user deposit pools were never exposed to the vulnerable contract.
- →Watch for the post-mortem expected within days: if the root cause is a Solana smart contract bug, Solana deposits will stay offline longer than the initial pause.
- relayer → A company or person who completes your cross-chain transfer using their own money first, then gets paid back by the protocol later.
- optimistic oracle → A system that assumes submitted data is correct unless someone challenges it within a set time window.
Across Protocol confirmed a Solana bridge attack early today, detected around 5:30 AM UTC. Solana deposits are disabled. Ethereum, Base, and other supported chains are running normally.
Only Risk Labs capital is at risk. Risk Labs is the foundation that operated the Solana-side relayer. User deposit pools were never in the vulnerable contract. Quietly, the architecture did exactly what it was designed to do.
Across uses a relayer model. Third parties front cross-chain orders with their own capital, then get reimbursed by the protocol later. Risk Labs played that role on Solana. When the attack landed, it landed on their balance sheet.
Across is working with SEAL_911, a crypto security response group, to track attacker-linked addresses. A post-mortem is expected within days. The root cause is still unknown. Possible causes: a Solana smart contract bug, a relayer configuration error, or an interaction with the UMA optimistic oracle.
Per Crypto Briefing, Across had processed over $35 billion in cumulative volume before the incident. That figure comes from a single report.
If you're using Across on Ethereum or Base, nothing changed for you. If you're waiting for Solana deposits to reopen, the post-mortem is your timeline.
Risk Labs is leaving a credibility gap open. The loss figure comes out in the post-mortem regardless. Releasing it now costs nothing.
Watch for the Across Protocol post-mortem, expected within days. A Solana smart contract bug as the root cause means deposits stay offline past the initial pause.
Primary links and supporting reads used by the desk for this story.
Forward this.
