Across Protocol Reports Relayer Security Incident and Limits Losses to Under $4 Million

Across Protocol has released a postmortem on a Relayer security incident. According to Foresight News, an attacker exploited a vulnerability in Risk Labs' off-chain event-reading software on Solana and forged 1,627 fake deposit events with a total face value of about $41.7 million. Relayer completed 581 advance payments before Solana services were paused, involving about $4.5 million in its own funds. The remaining fake deposits, totaling about $37 million, were invalidated. The incident did not involve a smart contract vulnerability, and all user transfers were completed the same day or fully refunded. The loss was limited to Risk Labs' own relayer capital, with about $4.5 million funded and net losses below $4 million after offsetting about $500,000 from the attacker. Solana order flow has now been routed entirely through CCTP, and the ACX token buyback plan remains unchanged.