On July 17, 2026, an attacker exploited a subtle flaw in Risk Labs’ Solana relayer software and managed to drain roughly $4.5 million from the relayer’s funds. Surprisingly, no user lost any money during the incident, as all genuine transactions were either completed or refunded promptly.
The vulnerability stemmed from an eight-byte check missing in the offchain code that Risk Labs used to interpret Solana’s onchain events. The attacker crafted fake deposit events that the relayer accepted as legitimate, even though these deposits never appeared on the blockchain itself. This gap between onchain reality and offchain interpretation created a deceptive window for the exploit.
Technically, this happened because the relayer's software trusted any event labeled with a specific authority address without verifying the unique event identifier, known as the Anchor event discriminator. The attacker abused this by injecting forged deposit notifications through a harmless read-only helper function. On blockchain level, no funds shifted, balances remained unchanged, and contracts were untouched. The entire deception happened within the offchain monitoring system.
Over about an hour from 05:07 to 06:14 UTC, the attacker submitted 1,627 fake deposit events spanning 18 different destination chains with a total face value nearing $41.7 million. The relayer processed 581 of these fake requests before Solana services were halted to prevent further damage. Risk Labs ended up covering a gross loss of approximately $4.5 million, with net losses expected to fall below $4 million as recovery efforts proceed.
Service restoration took roughly 12 hours, using a fallback routing method through the CCTP protocol. Law enforcement agencies and the SEAL 911 task force have joined the investigation to aid in fund recovery and track the attacker.
This incident highlights a critical lesson for blockchain projects relying on offchain infrastructure: even perfect onchain behavior can be undermined by software that assumes too much trust. Similar concerns have been raised in the broader crypto ecosystem, as recent moves towards regulation emphasize stronger oversight on such vulnerabilities.
