What Is Across Protocol? Relayers, Verification, Fees and Refunds

Who builds Across

Across is developed by Risk Labs, which also builds UMA, a decentralized oracle. On its website, Risk Labs Foundation dates its founding to January 2019 and lists Hart Lambur (CEO), Matt Rice (CTO), Melissa Quinn (COO) and Kevin Chan (Treasurer) among its leadership. In June 2025, Lambur publicly described Risk Labs as a Cayman Islands non-profit with no shareholders (The Block). The foundation's own site does not state its legal form.

The Across terms of service name "Risk Labs" as the operator of the interface. They say Risk Labs never has custody of user assets, treat relayers and liquidity providers as independent third parties, and set New York law and arbitration for disputes. Users who are sanctioned or based in comprehensively sanctioned jurisdictions are excluded, and the terms prohibit using VPNs to get around that.

How an Across transfer works

An Across transfer has three stages (Across docs):

1. Deposit. You deposit tokens into the Across SpokePool contract on the origin chain. The deposit names the destination chain, the recipient and the maximum fee you accept.
2. Fill. Relayers monitor deposits. One of them sends the recipient the equivalent tokens on the destination chain, minus fees, from its own inventory. At this point the user's transfer is complete. Across says most mainnet fills land in about two seconds.
3. Settlement. Later, a "dataworker" bundles all fills across chains into a single settlement proposal on Ethereum's HubPool. If no one disputes the bundle during the challenge window, relayers are repaid and pools are rebalanced through canonical bridges.

Across also uses liquidity providers, who deposit assets into the HubPool. That capital repays relayers and covers "slow fills" when no relayer steps in. In return, LPs earn a share of fees. Their main risks are locked capital and delayed withdrawals during heavy use.

Across transfers only canonical tokens, meaning the real USDC or WETH on each chain rather than a bridge-minted wrapped version. This avoids the extra trust layer a wrapped token adds. OBOL's bridging guide explains why that distinction matters.

How a transfer is verified: the optimistic model

Across is secured by an optimistic system, not a validator set or a multisig signing each transfer. Settlement proposals are assumed valid unless someone proves otherwise (security model docs):

• Bonds. Proposing a bundle requires a bond, about 0.45 ABT (Across Bond Token, a WETH-like token) as of October 2026. Disputing one requires the same bond.
• Challenge window. Anyone can check a proposed bundle against on-chain data during the dispute window. If it goes undisputed, the proposer's bond is returned.
• Disputes. A disputed bundle goes to UMA's Data Verification Mechanism, where UMA token holders vote. The losing side forfeits its bond.

Across puts the security assumption this way: "It only takes one honest actor to dispute and stop invalid transfers" (Across docs). The flip side is that the system depends on at least one watcher actually checking bundles, and on UMA's voting process being sound if a dispute escalates. For users, the relayer has already paid out before verification, so a faulty settlement would hit relayer and LP capital first.

What Across costs

The fee you see is a single quote, built from three parts:

Across docs do not publish a fixed formula, so compare the quoted output amount before signing. The terms state that gas costs may differ from estimates and that fees are generally not refunded.

Supported networks and assets

As of October 2026, Across's own pages disagree on the chain count. The docs introduction says 24 chains, the docs landing page says 26+, and the across.to homepage lists about 30, including Ethereum, Arbitrum, Base, Optimism, Solana, BNB Smart Chain, HyperEVM and HyperCore. Which token routes are open between any two chains changes over time, so check the route in the app before relying on it.

If a transfer isn't filled: refunds

Unfilled deposits are refunded, but not instantly (Across refunds docs). If no relayer fills a deposit before its fill deadline, the deposit is marked expired and the funds stay escrowed in the origin SpokePool. The refund is then processed through the next settlement bundle (roughly every 1.5 hours), its challenge period and canonical bridge delivery, so it can take several hours.

By default the refund goes back to the depositing address on the origin chain. Integrators can set a different refund address or destination-chain refunds. The docs describe expiries as rare and usually caused by very large transfers, unusual token pairs or temporary relayer downtime. You can follow a transfer's status in Across's status tracker.

Security record

• Audits. OpenZeppelin audited the Across v2 contracts, including the HubPool, SpokePools and chain adapters, in a report published May 11, 2022. It found one critical, four medium and eight low-severity issues, which were addressed in a fix review (OpenZeppelin). Later versions need their own audits, and the docs link to a bug bounty.
• Losses. The across.to homepage claims "no user funds lost" (company claim, as of October 2026).
• Self-custody risk. Across never holds your keys, so wallet compromise and malicious token approvals are on the user side.

OBOL's separate Across bridge review holds its editorial assessment.

ACX and governance

ACX is the Across governance token, an ERC-20 on Ethereum with a maximum supply of 1 billion (Etherscan). Holders vote in the Across DAO, including on treasury grants. You do not need ACX to bridge.

In June 2025, critics on X alleged that insider-linked wallets had voted through treasury grants of about $23 million in ACX to Risk Labs. A separate allegation claimed insider buying before ACX's December 2024 Binance listing. Lambur called the claims "categorically untrue" and said the grants funded Across v3 and v4 development. He committed to clearer voting disclosures on future proposals. As of the June 27, 2025 reporting, no regulator had acted and no evidence had been published to resolve the dispute (The Block).

Getting help

Across lists a Telegram support channel (t.me/acrosstg) on across.to, and the documentation includes troubleshooting tools and a deposit status tracker. Support staff should never need your seed phrase. Treat anyone who contacts you first, or who asks you to "validate" a wallet on another site, as a scammer.

Official channels

• Bridge app: across.to
• Documentation: docs.across.to
• X (Across): x.com/AcrossProtocol
• GitHub: github.com/across-protocol
• Telegram support: t.me/acrosstg
• Risk Labs: risklabs.foundation
• Risk Labs on X: x.com/risklabsfdn
• Risk Labs on LinkedIn: linkedin.com/company/risk-labs-foundation