Across Protocol

Across Protocol receives a C risk grade (46/100) from Hindenrank, where lower scores indicate lower risk. Elevated risk — first security incident confirmed July 2026 (off-chain relayer exploit, ~$4M net loss); governance centralized under AcrossCo after DAO dissolution; user funds were unaffected but off-chain attack surface is now a confirmed risk class A cross-chain bridge with a 4+ year operating history and $34B+ in total volume that experienced its first security incident in July 2026 — a $4.5M loss from off-chain relayer software manipulation on Solana. User funds and LP pools were never at risk; Risk Labs' proprietary relayer absorbed the full loss. The protocol transitioned from a DAO to a US C-corporation (AcrossCo) in April 2026 via a 91.51% governance vote. TVL has declined from a $249M peak to roughly $19M, and Solana routing now runs through Circle's CCTP rather than Across's intent-based architecture.

The key risks identified for Across Protocol are: (1) A July 2026 attack exploited a missing validation check in Across's Solana relayer software, draining $4.5M from Risk Labs' own funds. This proved that off-chain code — which doesn't appear in standard smart contract audits — is a real and confirmed attack surface. (2) Protocol governance is now controlled by AcrossCo, a private US company, after the DAO was dissolved in April 2026. There are no on-chain voting rights on protocol changes for ACX holders. (3) The system that verifies bridge transfers still uses UMA token voting, and a $7M attack on Polymarket (March 2025) proved that a single wealthy actor can accumulate enough votes to approve fake transactions using the same oracle mechanism.

Across Protocol scores 46/100 across eight risk dimensions: Mechanism Novelty: 6/15, Interaction Severity: 10/20, Oracle Surface: 7/10, Documentation Gaps: 2/10, Track Record: 8/15, Scale Exposure: 3/10, Regulatory Risk: 3/10, Vitality Risk: 7/10. The highest risk area is Oracle Surface at 7/10.

Among 28 rated Bridge protocols on Hindenrank, Across Protocol ranks #19 by safety (lowest risk score = safest). Its 46/100 risk score and C grade place it in the middle tier of Bridge protocols.

Across Protocol scores 8/15 on the Track Record risk dimension, indicating some history of security incidents or exploits. Higher scores reflect more severe or frequent incidents. Review the full risk report for details.