Risk Labs, the operator of Across, disclosed that the Solana relay attack on July 17 did not affect user funds, but approximately $4.5 million of its own relay capital was transferred out. The incident exposed a typical problem: the on-chain contract itself was not compromised; the vulnerability lay in the off-chain software that read on-chain events.
Attack occurred during off-chain event analysis
According to the disclosure, the attackers exploited a missing 8-byte checksum in the Solana relay code run by Risk Labs. This relay reads Solana SpokePool contract events and uses these events to advance funds on the target chain to complete cross-chain transfers.
The problem is that the relevant components lack an 8-byte discriminator for Anchor events. Attackers can therefore forge seemingly genuine deposit events, misleading the relayer into believing that a user has initiated a cross-chain deposit in Solana, and subsequently disburse funds incorrectly.
Risk Labs stated that the exploited `get_unsafe_deposit_id` is merely a read-only helper function and is not the root cause of the vulnerability. The real problem lies in the repeater's own event recognition logic.
1627 fake deposits were made within one hour.
The disclosure shows that the attack occurred between 05:07 and 06:14 UTC on July 17. The attackers submitted 1,627 fake deposits to 18 target blockchains through 1,627 one-time wallets, requesting a total face value of approximately $41.7 million.
Before the team shut down Solana as the source chain, Risk Labs' relayer executed 581 of these requests, actually disbursing approximately $4.5 million of its own funds. The remaining approximately $37 million in forged requests subsequently failed, resulting in no further losses.
- The total number of forged deposits was 1627.
- Involves 18 target chains
- 581 fraudulent requests have been executed.
User funds were unaffected.
Across stated that no user funds were lost or at risk throughout the entire process. This is because it uses the intents model: user assets are first deposited into the source chain custody contract, an independent relayer advances the funds to complete the transfer to the target chain, and then the protocol settles and verifies the transaction.
This means that the fake deposits did not touch the users' escrow assets. All genuine user transfers were either completed on the same day or refunded on the same day. Risk Labs also stated that the Solana program and EVM contract functioned as expected, and there was no intrusion at the smart contract level.
Risk Labs is currently bearing the losses itself. The company stated that the total cost of the repeater was approximately $4.5 million, of which about $500,000 of the attacker's funds remain tied up in the protocol, resulting in a net loss of less than $4 million, which may decrease further once recovered.
Solana service will be restored in approximately 12 hours.
Risk Labs suspended Solana-related services after discovering the anomaly and completed the remediation deployment on the same day. According to the disclosed timeline, the team first disabled Solana's inbound and outbound transfers at the API level, then suspended Solana SpokePool, and merged and deployed the root cause fix within a few hours.
At 17:05 UTC that day, Solana deposits were reopened via the CCTP backup route. Risk Labs stated that full service was restored within approximately 12 hours, and other chain and protocol functions were unaffected.
Going forward, Solana order flow will temporarily be processed only through the CCTP backup path. The team will re-audit Solana's off-chain event parsing logic and strengthen anomaly detection in order to identify such bulk fraudulent deposit activities earlier.
Additional information:Risk Labs stated that it has partnered with SEAL 911 and U.S. law enforcement to track funds, and the attacker's addresses have been flagged on exchanges and withdrawal channels.
