A Solana Bridge Lost $4.5M to a Hack. Every User Kept 100% of Their Funds.

It was a bridge that was used for millions of dollars, and at no point was a single dollar lost by any one of the users. The pair seems like an unlikely match, but it did occur on Across Protocol's Solana side on July 17.

Here's what actually occurred. A hacker set up 1627 fake wallets on Solana and sent fake deposits that were never recorded on-chain.

The false deposits totaled about $41.7 million and were issued to pay out to 18 different destination chains.

Before the team noticed and disabled Solana operations, Across's relayer (the Risk Labs foundation) filled 581 of those bogus requests.

The relayer's gross was approximately $4.5 million. About $500,000 of the attacker's money was stuck in the swindle, bringing the final loss to less than $4 million.

The significant aspect for those who actually use the bridge: it was no money of theirs.

In order for relayers to front their own capital for an instant settlement in an intent-based model, where they will be repaid onchain later, this will be done across runs. If anything breaks on the relayer side, then the relayer is eating the loss. Not the person that caused the transfer.

All legitimate transfers made thereafter were also processed and/or refunded. Within hours, Solana deposits were suspended, and the deposits were reopened within about 45 minutes via fallback routing via Circle's Cross-Chain Transfer Protocol.

It's a concept to keep in mind the next time a bridge headline goes "catastrophic". The dollar amount is not as significant as the architecture.

A hack that affects only the protocol's treasury is a different risk than a hack that affects a common pool of user deposits, though both may be reported the same way on social media.

A detailed technical analysis of the problem that led to the failure has yet to be completed and recovery of the locked-up funds continues.

If you believe that user money isn't at risk if the architect of the bridge is at risk, does that make you feel safer? Or does it make you feel less safe if the user ends up losing money no matter who loses what?

This is not financial advice.