What Happened During the July 2026 Attack on Across Protocol's Solana Deployment

Impact: Zero User Funds Lost

• No users were affected. Across confirmed that all cross-chain bridge transactions initiated before the breach were completed normally .
• Financial damage was limited to funds held by the Risk Labs-operated relayer — the internal infrastructure that facilitates cross-chain message passing . Exact dollar figures for the relayer loss have not been publicly disclosed, but multiple sources describe the impact as "limited" .
• The protocol's treasury and user-deposited capital in bridge pools were untouched .

Recovery and Investigation

• Immediate containment: Across suspended Solana deposit functionality within hours of detecting the attack, while all other protocol operations continued normally .
• Tracking the attacker: The project team, in coordination with SEAL-911, began tracking the attacker's addresses — one Solana address and two Ethereum addresses .
• Full service restored by July 18: Within roughly 24–30 hours, Across announced that full operations had resumed, Solana deposits were re-enabled, and any pending SOL transfers had been completed or refunded .
• A full post-mortem with detailed technical findings was promised by the team .

How Intent-Based Architecture Limited Damage

Across Protocol uses an intent-based architecture where users submit cross-chain intents and relayers compete to fulfill them by providing liquidity on the destination chain. This design inherently limited the blast radius:

• Relayer funds are isolated from the protocol's liquidity pools and user deposits. Compromising one relayer node affected only that relayer's capital, not the pooled user funds sitting in Across's spoke pools .
• The protocol did not need to pause globally. Only Solana deposits were suspended; the rest of the multi-chain system stayed live .
• All in-flight transactions were honored. Pending cross-chain transfers were either completed or refunded without user loss .

Broader Context: Cross-Chain Bridge Losses in 2026

The Across incident stands as a small and well-contained event in a year marked by massive bridge exploits:

• According to security firm PeckShield, cross-chain bridge protocols suffered $340.7 million in losses across 14 major exploits through early June 2026 .
• The single largest incident was the Kelp DAO / LayerZero bridge exploit in April 2026, which drained approximately $292 million of rsETH .
• Bridge hacks accounted for about 42% of all crypto exploit losses in May 2026 (roughly $28.6M of ~$70M total) .
• A separate industry tally by KuCoin estimated over $750 million in total crypto hack losses across 2026, with $329 million from bridge attacks alone .
• The Across attack appears to be among the smallest bridge incidents of the year, notable mainly for how little damage was done rather than how much — a direct result of its architectural safeguards.