Across Protocol exploit analysis

On 17 July 2026, the Solana deployment of the Across bridge was hacked for around $3.35 million. According to Across, the stolen funds belonged to Risk Labs, the foundation supporting the project, rather than users of the bridge. Across's tweet thread stated that no user funds were lost.

The mechanism was a relayer-side compromise. Across's cross-chain design uses relayers — off-chain actors who front liquidity on the destination chain and are reimbursed on the source chain. The attacker was able to drain Risk Labs' relayer-side balances on the destination chain, rather than compromise the bridge's lock-and-mint logic itself. The web3isgoinggreat account described the loss as around $3.35 million; crypto.news framed it as "under $4 million"; the Across account framed the user impact as nil. The attacker exploited the relayer infrastructure rather than the protocol's user-facing contracts, which is why the impact was corporate rather than customer-facing.

The figures are consistent. The web3isgoinggreat account put the loss at "around $3.35 million". crypto.news reported "under $4 million". The Across tweet thread, which was the project's own statement, framed the loss as Risk Labs' and put the dollar figure in the same range. No outlet reported a substantially different number.

The response was corporate. Across paused the affected relayer paths on Solana, made a public statement through its project account, and engaged outside security firms. No attacker was identified. The bridge continued operating on other chains after the Solana-specific incident was contained. The project also announced a separate token-to-equity initiative in the same period, suggesting the relayer loss did not materially change the project's longer-term direction.

Compared with the other 2026 bridge incidents in the corpus, the Across case is the smallest of the July 2026 cluster at $3.35 million, well below the Wanchain-Midnight bridge loss of $9-10 million and the Allbridge flash loan drain of $1.66 million. The Across case is unusual in that the loss was borne by the protocol's foundation rather than by users, which is a function of the protocol's design but also of the foundation's treasury size. The same design that allowed Across to absorb the loss without harming users is the same design that exposed the foundation's relayer balances to the attacker in the first place.