Between 05:07 and 06:14 UTC on 17 July 2026 an attacker submitted 1,627 forged Solana deposits (face value ~$41.7M) from single-use wallets across 18 destination chains; Risk Labs' relayer filled 581 of them, paying out roughly $4.5M of its own capital before Solana was disabled as an origin chain. No user funds were affected.

Cross-chain bridge protocol Across was attacked on its Solana deployment on July 17, 2026. The attacker exploited a gap in Solana’s event system to spoof deposit signals, tricking relayers into paying out on fake deposits. User funds remained completely safe with zero losses; all transactions were completed or fully refunded. Losses were contained to the Risk Labs-operated relayer. The team paused Solana deposits and restored operations the next day, with a full post-mortem planned.