Hook The wire tap was silent until the first transaction failed. On an undisclosed date, Across Protocol’s Solana bridge deployment was compromised—not a whisper on the chain before the deposit function was frozen. I saw the wire tap before the wallet drained. The attacker moved fast, but the team moved faster to lock the gates. The official statement: “User funds are safe.” But safe from what, exactly? And for how long?

Context Across Protocol is a cross-chain bridge leveraging UMA’s Optimistic Oracle for price attestation. It connects Ethereum, Arbitrum, Optimism, Base, and now—or rather, briefly—Solana. The Solana deployment was a strategic expansion into a high-throughput, non-EVM ecosystem. Bridges are critical infrastructure; they are also the most targeted pieces of DeFi. Since 2021, over $2.5 billion has been lost in bridge hacks (Ronin, Wormhole, Harmony). Across had so far avoided major incidents. Until now.

The attack was announced via a terse Twitter thread: “We are aware of an incident affecting our Solana bridge deployment. Deposits have been disabled. User funds are not at risk.” No technical details. No post-mortem. For a protocol that prides itself on transparency, this silence is a signal.

Core Based on my audit experience—having reversed smart contract exploits in real-time since 2019—I can reconstruct the probable attack vector. The phrase “bridge deployment” is key. It implies the compromise occurred during the deployment phase, not in the core bridge contract that has been battle-tested on other chains. Common deployment-stage exploits include:

1. Misconfigured admin keys: The deployer wallet might have been a multisig with insufficient signer distribution, or a single EOA holding the owner() role. Once compromised, the attacker could call privileged functions like updateWormholeBridge or setFeeAccount.

1. Front-running the initialization: If the implementation contract was deployed and then the proxy was initialized separately, an attacker could front-run the proxy initialization and set their own admin. This is a known vulnerability in upgradeable proxy patterns (see: Parity multisig hack, but for bridges).

1. Oracles being tricked: Across relies on UMA’s Optimistic Oracle for price data. If the Solana deployment used a different oracle configuration—or worse, a custom, unaudited price feed—the attacker could manipulate the attestation to drain funds.

But the statement “user funds are safe” narrows the scope. It suggests the attacker did not reach the liquidity pool. Perhaps the exploit was detected and halted before any cross-chain message was processed. In bridge architecture, the liquidity pool is the ultimate target. If deposits are disabled, the attacker cannot inject malicious messages to withdraw from the pool. This is a containment win.

Yet, without a detailed post-mortem, I cannot verify the claim. I trust no one, verify the chain, strike first. Using public block explorers, I attempted to trace the incident. The Solana bridge contract addresses were not disclosed publicly. The across protocol team has not yet published a transaction hash or affected block range. This opacity is a red flag for a protocol that markets itself as transparent.

Let’s zoom into the timing. The attack was announced, then deposits disabled. In a typical bridge, deposits are handled by a “depositor” contract that locks tokens on the source chain and emits an event. The off-chain relayer listens to that event and submits it to the destination chain via the Oracle. If the attacker compromised the deployment script, they could have introduced malicious code to the depositor contract that allows them to mint arbitrary tokens on Solana without a corresponding lock on Ethereum. But if deposits were disabled before the first malicious deposit? That would be a miracle of SOC monitoring—or the attacker was still probing.

I’ve seen this before: during the Terra/Luna collapse arbitrage, I watched liquidation cascades in real-time. The speed of response determined who survived. Across’s rapid deposit freeze suggests they have active monitoring—a positive sign. But speed is the only currency that doesn't depreciate. The clock is now ticking on the post-mortem.

Contrarian The conventional narrative will be: “Another bridge hack, user funds safe, buy the dip.” I disagree. The real risk is not the immediate financial loss—it’s the governance failure that allowed the deployment to be exploited in the first place. Most DAOs have the legal status of “no legal status”; when things go wrong, members face unlimited personal liability. Across Protocol’s governance, if it exists for the Solana deployment, might have approved a deployment contract without rigorous external audit. This is leverage waiting to be wielded.

Consider: why was the Solana bridge deployment not independently audited by a firm like Trail of Bits or OpenZeppelin? The Across core contracts are audited, but new deployments often reuse code without re-auditing the integration. This oversight is systemic. In 2024, the Nomad bridge exploited a keccak hash collision bug that was missed in audit because the deployment script was out of scope. Across’s Solana deployment may have fallen into the same trap.

Furthermore, the statement “user funds are safe” may be technically true today, but what about accumulated fees, protocol-owned liquidity, or unclaimed rewards? The attacker could have siphoned off non-user assets without affecting the pool. The team didn’t mention protocol funds. That’s an information gap big enough to drive a truck through.

Takeaway Don’t relax. Watch for the post-mortem. If it arrives within 48 hours with full transaction logs, contract addresses, and a clear root cause, trust can be rebuilt. If the team goes dark—as many do after incidents—consider that a signal. The crash wasn't the exploit; it was the silence that followed. I’ll be monitoring the chain for any sign of the attacker’s next move. While you read the news, I trade the rumor. My next signal: watch the UMA token price. If it drops below $2.50, the market is pricing in systemic risk. Otherwise, this is a blip. But trust no one, verify the chain, strike first.

— Avery Martin

TL;DR: Across Protocol’s Solana bridge was attacked. User funds declared safe. But the lack of transparency and deployment governance is the real vulnerability. Wait for the post-mortem before re-entering.