Relay suffered a sandwich attack due to an API vulnerability and will compensate affected users with approximately $312,000.

TechFlow reported on September 29 that cross-chain payment and trading protocol Relay disclosed a vulnerability in its API interface that led to the leakage of pending transaction information. Maximum Extractable Value (MEV) searchers exploited this vulnerability to execute sandwich attacks between September 12 and 26, accumulating approximately $136,000 in profits.

The incident affected approximately 5,600 users, with a median affected amount of $11.88. Relay stated it will award a $50,000 bug bounty to the reporter and fully compensate all affected users, with a total compensation pool of approximately $312,000. Funds will be distributed directly to the wallets of affected users without requiring manual claims. The issue has been identified, and the team continues to enhance transaction execution privacy and security.