Across Protocol Solana Bridge Exploit (July 2026)
Summary
On July 17, 2026, an attacker exploited a flaw in Risk Labs' off-chain event-reading software for the Solana deployment of Across Protocol, a cross-chain bridge with over $34 billion in cumulative bridged volume. The attacker forged 1,627 deposit signals — exploiting Solana's lack of a canonical event system — tricking the Risk Labs-operated relayer into paying out approximately $3.35 million in net losses, while blocking an additional $37 million in fraudulent requests. No user funds were lost; all losses came from Risk Labs' own relayer capital, and Solana deposits were restored within roughly 12 hours via Circle's Cross-Chain Transfer Protocol (CCTP).
Connected Entities
2 entities · 10 linked investigations- 8bkoZTaTBBtAPczgHqD4XVxWtvBkiy4crtexEtYDYSL→mentioned with→Across Protocol Solana Bridge Exploit (July 2026)(50%)
Timeline(10 events)
2026-04-22
Asymmetric Research publicly discloses a vulnerability in Across Protocol's Solana event handler. The disclosure details how failed transactions can emit events that a naive off-chain indexer cannot distinguish from successful ones, enabling deposit spoofing. Across patches the issue within hours; no funds are lost.
Asymmetric Research Blog2026-03-12
Across Protocol announces 'The Bridge Across' proposal to dissolve its DAO and form AcrossCo, a U.S. C-corporation. ACX token surges approximately 80% on the announcement.
CoinDesk2026-03-26
Across Protocol DAO votes on the transition to AcrossCo; the proposal passes with 91.51% of votes in favor.
Phemex News2026-07-17
At 05:07 UTC, an attacker begins submitting 1,627 forged deposit events from 1,627 single-use Solana wallets, requesting payouts across 18 destination chains with a combined face value of approximately $41.7 million.
crypto.news2026-07-17
At approximately 05:30 UTC, Across Protocol detects the attack. Risk Labs' relayer has by this point filled 581 of the fraudulent requests, advancing approximately $4.5 million. The team disables Solana as an origin chain, blocking the remaining 1,046 requests worth approximately $37 million.
Crypto Briefing2026-07-17
Across Protocol issues a public statement confirming the Solana bridge attack. 'Solana deposits have been disabled. The protocol is otherwise operating unaffected.' SEAL 911 is engaged to monitor flagged attacker addresses. All in-flight legitimate transfers are completed or fully refunded.
Web3 Is Going Great2026-07-18
Across Protocol restores Solana bridge deposits within approximately 12 hours of the attack, using Circle's Cross-Chain Transfer Protocol (CCTP) as an alternative routing mechanism. Full operations are confirmed.
KuCoin News2026-07-22
AFX Trade, an Arbitrum-based perpetuals DEX, is drained of $24.15 million after an attacker obtains private keys from five bridge validators, reaching withdrawal quorum. Security firm Blockaid flags the exploit at 21:30 UTC.
CoinDesk2026-07-23
The Verus-Ethereum bridge is exploited for $7.54 million in a second attack against the same protocol within two months, attributed to a different wallet than the May 2026 incident.
CryptoTimes2026-07-26
July 2026 bridge hack losses are reported at approximately $47 million in the prior week across AFX Trade, Wanchain, and Verus, with cumulative July losses approaching $97 million.
CryptoTimesDecision Log
- #1publish⛓ pending7/29/2026, 12:15:30 PMhash: 5kFeDbijY79Ps6D7hCSiLNp2B1uioxUbuf9a3XX2wGcm
13 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/29/2026, 12:15:11 PM
last updated: 7/29/2026, 8:29:07 PM
avoid.net — verified advice for a post-truth world