Across Protocol

1. 01You deposit on the origin chain into Across's SpokePool contract, stating what you want to receive and where.
2. 02A relayer fills the order on the destination chain from its own funds, usually within seconds.
3. 03Every so often a proposer bundles recent fills into a "root bundle" and posts it to Ethereum with a bond. Anyone can dispute it through UMA's optimistic oracle during the challenge window.
4. 04Once the bundle stands, the relayer is repaid (plus its fee) from the HubPool on Ethereum, where liquidity providers deposit.

The point of this order is that you are paid before the slow settlement happens, and the relayer, not you, waits for it and carries the risk of a bad fill. Across also routes USDC over Circle's CCTP and USDT over LayerZero's OFT standard where those are cheaper (docs). An upcoming V4 replaces parts of the optimistic check with zero-knowledge proofs from Succinct's SP1.

The design limits what an attacker can take from users in transit: you are paid by a relayer within seconds, and deposits sit in the SpokePools only until they are swept into relayer repayments. What remains exposed is the HubPool LP capital and whatever the oracle accepts. A wrong bundle has to survive UMA's dispute window with a bond at stake.

That record is no longer clean. DefiLlama lists a $4.5 million exploit on 17 July 2026 on Across's Solana deployment, classified as a spoofed event log, a cross-chain message the system accepted without it being real (DefiLlama hacks). We could not find an Across post-mortem on its blog, docs or forum as of 27 September 2026, so we do not know whether LPs or users bore the loss.

If you bridge large amounts, split the transfer or use a route with the chain's canonical bridge. Speed is what you pay a third-party bridge for; it does not remove the extra trust layer.

The fee is the difference between what you send and what arrives, quoted before you sign (fees docs).

On 11 March 2026 Risk Labs proposed turning Across from a token-governed DAO into a private US C-corporation, Across, Inc. ("AcrossCo"), arguing that the token structure "materially impacted" institutional partnerships and compliance (proposal). The Snapshot vote passed; the portal, delayed from July by legal work, opened on 17 September 2026.

After 8 January 2027 ACX will have no governance, utility or economic function, and Risk Labs and AcrossCo say they have no further obligations to holders (portal notice). Tokens must be in a self-custodied wallet to take part; exchanges may delist ACX before then. The buyout is funded from Across's treasury, which Risk Labs said roughly matched the token's market cap.