Across Review 2026: An Intents-Based Bridge, and What the July Relayer Incident Showed

Across is a cross-chain bridge and swap service built on intents: you state what you want, and independent relayers front their own capital to deliver it on the destination chain. This review covers what I could see and verify on 9 November 2026, and where the evidence stops.

Quick verdict: Across has one of the simplest bridge screens I have used, a documented security model built on optimistic verification, and a recent independent audit with no critical or high findings. The trade-offs are variable fees you only see in a quote, a dependence on relayers and UMA’s oracle, and a July 2026 incident that hit Across’s own relayer.

Item	Detail
Best for	Moving stablecoins and ETH between EVM chains quickly, with a simple interface
Fees	LP fee plus relayer fee, both folded into the difference between what you send and receive
Custody	Non-custodial, you connect your own wallet
Audits	Multiple, including OpenZeppelin on the V5 system in July 2026
Editorial score	4.2 / 5

What I tested, and what I did not

I opened across.to on desktop (1440px), tablet (1024px) and phone (430px), read the fee, audit and security model docs, then connected a throwaway MetaMask wallet that holds no funds. I did not enter an amount, request a quote or bridge anything, so statements about real fees, speed and slippage come from documentation and reports, not from my own transfers.

What Across actually is

Across calls itself a place to “bridge and swap across chains”, and the page tagline reads fast, cheap, secure. The transfer card has a From side and a To side, each with a token and chain. By default it showed USDC on Base going to USDC on Arbitrum, with an “Across V5” label above the action button.

The nav has Transfer, History, Support and Docs, so the whole product is one screen plus a history page. I did not open History.

How an intent bridge works

Across explains in its own blog that when you bridge, your wallet sends a transaction to a smart contract on the origin chain, and independent relayers race to fill the request using their own capital. The first relayer to deliver funds on the destination chain wins, and relayers are reimbursed later through a settlement process. That is why a transfer can land in seconds even though verification takes longer.

The security docs describe optimistic verification. A dataworker bundles fills into a root bundle, proposes it to the HubPool on Ethereum and posts a bond. During a challenge period anyone can dispute it, and disputes go to UMA token holders for a vote, with the losing side forfeiting its bond. Across says the system needs only one honest actor to dispute an invalid proposal.

Using Across on desktop, tablet and phone

The same card scales cleanly. On tablet it is centered with larger spacing.

Tablet view at 1024px. Nothing is cut off. On phone the logo shrinks to an icon, and the Connect button and menu sit at the top.

Best for: a quick bridge from any device without learning a new interface.

Connecting a wallet

The Connect Wallet panel groups wallets by chain family. Under Ethereum wallets it lists MetaMask (marked installed), Coinbase Wallet and WalletConnect. Under Solana wallets it lists MetaMask, Ledger, Phantom, Solflare and WalletConnect, and under Tron wallets it lists WalletConnect and TronLink.

Connect panel. Grouping wallets by chain is clearer than a single long list. I picked the Ethereum MetaMask option and approved a normal connection window for across.to.

MetaMask connect request. It states the site cannot move funds without your permission. After approval, the header showed 0x53…A0cD, the From card switched to USDC on Ethereum with a balance of 0, and the recipient defaulted to my own address. The button read “Enter an amount to continue”.

Connected state. Balances are zero because the wallet is empty, and I stopped here. I did not need to sign a message to connect.

Fees and costs

The fee docs say all fees come from the spread between what you deposit and what you receive, so the total fee is the input amount minus the output amount. That fee has two parts. The LP fee goes to liquidity providers and follows a utilization-based curve adapted from lending protocols, so it rises as a pool is used more. The relayer fee covers gas, the relayer’s capital opportunity cost and the risk it takes. The docs also say LP fees are zero when the relayer takes repayment on the origin chain.

The practical takeaway is that you will not see a flat fee. You see the quote for your amount and route, and it can change with pool utilization and gas. I did not enter an amount, so I cannot report a real quote. You also pay gas on the origin chain for the deposit.

Security, audits and the July incident

The audits page lists the Across V3, V3 incremental and V2 audits, an audit of the Across token and distributor, and several UMA audits, plus a bug bounty. In August 2026, OpenZeppelin published an audit of the Across V5 bridging system, covering work from 6 to 22 July 2026. It reports 19 issues with no critical and no high findings, 2 medium findings that were resolved, and 7 low findings, 3 of which were resolved. I read the summary, not the full findings.

On 17 July 2026, Across says an attacker exploited a bug in the Risk Labs relayer’s offchain event-reading software for Solana. In its post-mortem, Across says the attacker forged deposit events for deposits that never existed, and the Risk Labs relayer filled them with its own capital. It says no user funds were lost or at risk, no smart contract was exploited, and service to Solana was restored in about 12 hours through fallback CCTP routing. It reports 1,627 forged deposits worth about $41.7M face value across 18 destination chains, with 581 filled for about $4.5M, which fell on the relayer. That account comes from Across itself, and I did not find an independent review of it.

The incident is a useful illustration of the intents model, since relayer capital took the first loss, but it also shows that offchain software around the contracts is part of the attack surface.

A wider caution comes from an r/ethereum thread on 2026 DeFi hacks, where the poster argues that bridges keep producing the largest single losses. The thread is about bridges in general, not Across, and its figures are the poster’s, so I use it for sentiment only.

Who should use Across

Good fit:

• Users who want a quick, simple stablecoin or ETH transfer between chains
• People comfortable with an optimistic, relayer-based security model
• Developers who want to integrate an intents bridge

Think twice:

• Anyone who wants a fixed, predictable fee before seeing a quote
• Users moving very large amounts, who should split or test first
• People who want a model with no reliance on relayers or UMA’s oracle

FAQ

Is Across safe?

It is non-custodial, audited several times and has a documented dispute model, but bridges are high-value targets and a relayer-side incident occurred in July 2026. Test with a small amount first.

Does Across charge fees?

Yes, through an LP fee and a relayer fee folded into the difference between what you send and receive, plus origin-chain gas. LP fees can be zero in some cases.

How fast is it?

Across says relayers fill transfers within seconds. I did not bridge, so I cannot confirm times.

Which wallets work?

MetaMask, Coinbase Wallet and WalletConnect for Ethereum, plus MetaMask, Ledger, Phantom and Solflare for Solana, and TronLink for Tron.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.