Track market-moving stories before they get noisy

Across Protocol’s Risk Labs-operated relayer lost less than $4 million after an attacker fabricated $41.7 million in Solana deposit events, according to a post-incident report released by the cross-chain protocol.

Summary

1,627 fake deposits worth $41.7 million targeted 18 chains during the Solana attack. Risk Labs’ relayer paid $4.5 million across 581 fraudulent requests before suspending service. Around $500,000 in attacker funds remained trapped, reducing the net loss below $4 million. Across restored Solana transfers through CCTP, while user funds and the ACX buyback remained unaffected. Across attacker forged 1,627 Solana deposits The attack occurred between 05:07 and 06:14 UTC on July 17, according to the Across Protocol post-mortem. The attacker used 1,627 single-use Solana wallets to create the same number of fake deposit events.

Those deposits carried a combined face value of approximately $41.7 million and requested payments across 18 destination chains. Across reported that the funds were directed toward one recipient address on an Ethereum Virtual Machine-compatible network.

Risk Labs’ relayer filled 581 requests before Across stopped Solana operations. Those payments represented about 35.7% of the fraudulent requests but only 10.8% of their stated value.

The relayer advanced approximately $4.5 million of its own capital. Across invalidated the remaining 1,046 requests, preventing about $37 million in additional payouts.

Approximately $500,000 belonging to the attacker remained trapped within the protocol. Across deducted that amount from the gross payout to place its net loss below $4 million.

Why Across users avoided the relayer loss Across attributed the breach to a flaw in Risk Labs’ off-chain event-reading software rather than a vulnerability in its smart contracts. The protocol also reported that the attacker did not compromise the Solana network.

Across uses relayers that advance their own assets to complete cross-chain transfers before claiming repayment. That structure left Risk Labs’ relayer responsible for the loss instead of users who had submitted legitimate transactions.

All valid transfers were completed or fully refunded on July 17, according to Across. The protocol’s website shows that it has processed more than $34 billion in transfers without reporting a loss of user funds.

The incident differed from the Lien Finance exploit reported by crypto.news on July 24. SlowMist found that Lien’s attacker exploited a smart contract validation flaw to mint unsupported bond tokens and withdraw approximately 542,144.63 USDC.

crypto.news also reported that a wallet linked to the $285 million Drift Protocol exploit moved 23,095.1 ETH, worth about $44.4 million, through Tornado Cash on July 23 and July 24. Together, the incidents involved separate attack methods: off-chain software failure at Across, faulty contract logic at Lien, and post-exploit laundering tied to Drift.

What the CCTP shift means for US users Across restored Solana service in approximately 12 hours by routing transfers through Circle’s Cross-Chain Transfer Protocol. The protocol reported that its engineers deployed the root-cause fix about five hours after the attack.

The change has a direct U.S. connection because Circle issues USDC and operates CCTP. Circle states that CCTP burns native USDC on the source network and mints the same amount on the destination network without using traditional bridge liquidity pools or third-party fillers.

For U.S. users moving USDC to or from Solana, the fallback allowed transfers to resume without relying on the affected Risk Labs event reader. The Across breach did not involve USDC’s reserves or Circle’s minting contracts, according to the protocol’s findings.

The shift also comes after the United States established its first federal payment-stablecoin framework through the GENIUS Act. The law requires permitted issuers to maintain qualifying reserves and publish regular disclosures, according to a White House fact sheet. Those rules govern stablecoin issuers rather than the separate relayer software that caused the Across loss.

ACX buyback remains unchanged ACX traded near $0.041 after the post-mortem, with a market capitalization of about $29 million, according to CoinGecko. The token remained more than 97% below its all-time high.

Across stated that the loss would not affect its planned ACX token buyback. However, the protocol did not disclose whether Risk Labs would change its relayer funding, monitoring systems or operating limits.

Solana order flow remains routed through CCTP. Across has not provided a timeline for returning to its earlier routing system or announced the recovery of any additional funds.

ACX, the native token of Across Protocol, has dropped sharply following serious allegations of insider self-dealing involving $23 million in decentralized autonomous organization funds.

The token is trading at $0.1342, down 10% in the past 24 hours and over 40% in the past month. It’s now 91% below its all-time high of $1.69 set in December 2024.

The allegations were made public on June 27 by Ogle, the pseudonymous founder of Layer 1 project Glue and advisor to World Liberty Financial. In a detailed post on X, Ogle accused the Across Protocol team, particularly project lead Kevin Chan and chief executive officer Hart Lambur, of orchestrating two secretive proposals that directly benefited their own company using undisclosed wallets.

TLDR: Across Protocol/Bridge ($ACX) team used secret votes to extract ~$23m from the Across DAO’s treasury for their own private company's benefit.

Background: I’ve many times posted about DAOs that are DAOs “in name only” – that is, organizations that pretend to be run by “the…

— ogle | glue.net (@cryptogle) June 26, 2025 These proposals, made to appear as having community support, transferred 150 million ACX tokens worth about $23 million at current prices to Risk Labs over two separate governance votes. The first vote in October 2023 granted 100 million ACX under the pretense of future development support, with claims that the tokens would not be sold for two years.

But soon after, Risk Labs allegedly began selling token option agreements to external investors  A second vote, for “retroactive funding” of 50 million ACX, passed primarily due to insider-controlled wallets. Without those votes, it would not have reached quorum.

The report argues that such actions run counter to DAO governance principles and create significant future sell pressure, especially harmful to ACX holders unaware of the conflicts of interest behind these decisions. Across Protocol has not publicly responded to the allegations at the time of writing.

Looking at the technical picture, the chart shows clear downward pressure. The token is currently hugging the lower Bollinger Band at $0.1308 and trading below its 20-day simple moving average of $0.1597. At 31.27, the relative streghth index, which is trending downwards, is close to oversold territory.

ACX price analysis. Credit: TradingView More declines may occur if the price breaks through the $0.13 support zone. Some investors may watching for a bounce move back toward the mid-Bollinger band despite the sell-off. However, in the short term, upward momentum might be limited due to deteriorating sentiment and eroded trust in the team.