A cross-chain relay run by Risk Labs lost less than $4 million after an attacker fabricated $41.7 million in Solana deposit events, according to a post-incident report released by the cross-chain protocol.
summary
- 1,627 fictitious deposits worth $41.7 million 18 chains were targeted during the Solana attack.
- The cost of the Risk Labs migration has been paid $4.5 million through 581 fraudulent applications Before suspending the service.
- around The attackers’ funds amounting to $500,000 remained trappedWhich reduced the net loss to less than $4 million.
- Via Solana Recovered transfers through CCTP, while User funds and ACX buybacks remained unchanged.
The attacker forged 1,627 Solana deposits
The attack occurred between 05:07 and 06:14 UTC on July 17, according to Via postmortem protocol. The attacker used 1,627 single-use Solana wallets to create the same number of fake deposit events.
These deposits carry a combined face value of approximately US$41.7 million and require payments across 18 destination chains. It was reported that the funds were directed towards a single recipient address on an Ethereum Virtual Machine compatible network.
The Risk Labs relayer filled 581 orders before shutting down Solana operations via Across. These payments represent about 35.7% of fraudulent orders but only 10.8% of their declared value.
The migration company provided approximately $4.5 million of its own capital. The remaining 1,046 orders were invalidated, preventing the payment of about $37 million more.
Nearly $500,000 belonging to the attacker remained trapped within the protocol. By deducting this amount from the total payout to put a net loss of less than $4 million.
Why cross users avoid relay loss
The hack was attributed to a flaw in Risk Labs’ off-chain event reading software rather than a vulnerability in its smart contracts. The protocol also stated that the attacker did not compromise the Solana network.
Cross uses relays that offer their own assets to complete on-chain transfers before demanding payment. This structure left the Risk Labs sender responsible for the loss rather than the users who submitted legitimate transactions.
All valid transfers were completed or fully refunded on July 17, according to Cross. The protocol website states that more than $34 billion in transfers Without reporting the loss of user funds.
The incident is different from the Lien Finance exploit I mentioned By crypto.news on July 24. SlowMist found that a Lien attacker exploited a smart contract validation vulnerability to mint unbacked bond tokens and withdraw approximately $542,144.63.
crypto.news also reported that the wallet is linked to $285 million The Drift Protocol exploit has been moved 23,095.1 ETH, worth about $44.4 million, through Tornado Cash on July 23 and 24. Together, the incidents involved separate attack methods: off-chain software failure in Across, faulty contract logic in Lien, and post-exploitation washes associated with Drift.
What the CCTP shift means for users in the US
Via Solana service restored in about 12 hours by routing transfers through Circle’s cross-chain transfer protocol. The protocol reported that its engineers deployed a root cause fix about five hours after the attack.
The change has a direct connection to the US because Circle issues USDC and runs CCTP. The department stipulates that CCTP burns the original USDC on the source network and mint the same amount on the destination network without using traditional liquidity pools or third-party padding.
For US users transferring USDC to or from Solana, the fallback allowed transfers to resume without relying on the affected Risk Labs Event Reader. The overall hack did not involve USDC reserves or Circle’s mint contracts, according to the protocol’s findings.
This shift also comes after the United States created the first federal stablecoin framework for payment through the GENIUS Act. The law requires permitted issuers to maintain qualifying reserves and publish regular disclosures, according to A White House Fact Sheet. These rules govern stablecoin issuers rather than a separate migration program that caused the overall loss.
The ACX buyback remains unchanged
ACX was trading near $0.041 post-mortem, with a market cap of about $29 million, according to Queen Gekko. The token remains more than 97% below its all-time high.
Cross stated that the loss will not affect the planned ACX token buyback. However, the protocol did not reveal whether Risk Labs would change migration funding, monitoring systems, or operating limits.
Solana request flow remains routed via CCTP. Cross has not provided a timeline for returning to its previous routing system or announced any additional refunds.
