Across says $4.5M lost in July 17 exploit, user funds remain safe

Cross-chain bridge protocol Across (ACX) said on its official X account that it lost about $4.5 million in an exploit on July 17, while user funds remain safe. Across said the attacker exploited a bug in relay software that reads Solana (SOL) off-chain events, forged deposit events that did not exist, and caused the relayer to treat them as legitimate deposits and pay out its own funds. As a result, about $4.5 million of the relayer’s own funds was drained, but no user funds were affected. Across added that its smart contracts and Solana programs were not hacked, it deployed a patch within five hours of detecting the issue, and its ACX buyback plan will proceed as scheduled.