Incident Overview and Root Cause
Published 7/18/2026, 3:41:39 AM
Across Protocol's Solana deposit fix appears to have successfully stabilized user trust following the July 17, 2026, incident. Trust recovery is currently categorized as High/Stable because the protocol's intent-based architecture ensured that zero user funds were lost; the exploit only impacted the foundation-operated relayer (Risk Labs) [Source: https://across.to/blog/solana-incident-report].
Incident Overview and Root Cause
The incident occurred on July 17, 2026, at approximately 05:30 UTC. The vulnerability was identified as "Solana Event Spoofing," which exploited architectural differences between Solana and EVM chains.
| Metric | Details |
|---|---|
| Incident Date | July 17, 2026 |
| Root Cause | Solana failed transactions emitting data that relayers misinterpreted as valid deposits. |
| User Fund Impact | $0.00 lost (All user transactions completed successfully). |
| Relayer Impact | Risk Labs' relayer capital was the only source of exposure. |
| Security Partners | SEAL_911 and Asymmetric Research. |
The vulnerability allowed attackers to trick relayers into filling orders for deposits that never actually cleared on the Solana network [Source: https://across.to/blog/solana-incident-report].
Technical Fix and Remediation
Across Protocol implemented a fix within hours of detection. The remediation involved:
- Temporary Pause: Solana deposits were briefly halted to prevent further exploitation.
- Code Update: A fix was deployed to the SDK (Commit
a9ca75bc3e891d17c2d120279249ec271a60d4f5) to correctly validate Solana transaction states before relaying [Source: https://github.com/across-protocol/sdk/commit/a9ca75bc3e891d17c2d120279249ec271a60d4f5]. - Bounty Program: A reward was paid to Asymmetric Research for their assistance in identifying the vulnerability [Source: https://across.to/blog/solana-incident-report].
Evidence of Trust Recovery
While specific post-incident deposit volume data is still stabilizing, several indicators suggest a rapid recovery of user confidence:
- Architectural Validation: The event served as a "live test" of Across's safety model. Because relayers take the inventory risk rather than the protocol's liquidity pools, users remained unaffected even during an active exploit.
- Transparency: The team provided immediate public disclosure, including the identification of attacker addresses (
8bkoZ...and0xa0C0e...) [Source: https://across.to/blog/solana-incident-report]. - Sentiment Stability: There has been no evidence of a "bank run" or mass withdrawal from Across liquidity pools following the fix. Market sentiment remained stable despite broader negative pressure on Solana (SOL) during early July 2026.
Note: A full official post-mortem is expected by July 20, 2026, which may provide further technical details on the long-term security enhancements for the Solana integration [Note: not independently confirmed].