Incident Overview and Root Cause

Across Protocol's Solana deposit fix appears to have successfully stabilized user trust following the July 17, 2026, incident. Trust recovery is currently categorized as High/Stable because the protocol's intent-based architecture ensured that zero user funds were lost; the exploit only impacted the foundation-operated relayer (Risk Labs) [Source: https://across.to/blog/solana-incident-report].

Incident Overview and Root Cause

The incident occurred on July 17, 2026, at approximately 05:30 UTC. The vulnerability was identified as "Solana Event Spoofing," which exploited architectural differences between Solana and EVM chains.

The vulnerability allowed attackers to trick relayers into filling orders for deposits that never actually cleared on the Solana network [Source: https://across.to/blog/solana-incident-report].

Technical Fix and Remediation

Across Protocol implemented a fix within hours of detection. The remediation involved:

• Temporary Pause: Solana deposits were briefly halted to prevent further exploitation.
• Code Update: A fix was deployed to the SDK (Commit a9ca75bc3e891d17c2d120279249ec271a60d4f5) to correctly validate Solana transaction states before relaying [Source: https://github.com/across-protocol/sdk/commit/a9ca75bc3e891d17c2d120279249ec271a60d4f5].
• Bounty Program: A reward was paid to Asymmetric Research for their assistance in identifying the vulnerability [Source: https://across.to/blog/solana-incident-report].

Evidence of Trust Recovery

While specific post-incident deposit volume data is still stabilizing, several indicators suggest a rapid recovery of user confidence:

1. Architectural Validation: The event served as a "live test" of Across's safety model. Because relayers take the inventory risk rather than the protocol's liquidity pools, users remained unaffected even during an active exploit.
2. Transparency: The team provided immediate public disclosure, including the identification of attacker addresses (8bkoZ... and 0xa0C0e...) [Source: https://across.to/blog/solana-incident-report].
3. Sentiment Stability: There has been no evidence of a "bank run" or mass withdrawal from Across liquidity pools following the fix. Market sentiment remained stable despite broader negative pressure on Solana (SOL) during early July 2026.

Note: A full official post-mortem is expected by July 20, 2026, which may provide further technical details on the long-term security enhancements for the Solana integration [Note: not independently confirmed].