Cross-chain transaction protocol Relay will pay about $31,000 in compensation after a sandwich attack exploited an API vulnerability.

Cross-chain trading protocol Relay disclosed on September 29 that its API had exposed pending transaction information, enabling maximal extractable value searchers to front-run and sandwich user orders. The protocol will automatically pay about $312,000 to affected users, according to the disclosure reported by BlockBeats.

The disclosure gives a clear view of how transaction visibility can affect cross-chain trading. The affected users did not lose assets through a direct theft described in the disclosure, but their orders were executed under worse conditions because searchers could act on pending transactions.

A two-week window, with losses concentrated late in September

Relay said the events occurred mainly between September 12 and September 26, with the heaviest impact from September 23 to September 26. About 5,600 users were affected. The median loss was about $11.88, while the searchers collectively gained about $136,000.

The figures show a broad incident: the median loss was modest, but the total compensation reached $312,000, more than the reported searcher gain.

How the API exposure turned into sandwich attacks

The disclosure focused on an API that revealed transactions before they were executed. In a sandwich attack, a searcher places one transaction before the user's order and another after it, pushing the user into a less favorable execution. When pending transaction information is exposed, that pattern becomes easier to exploit.

Relay described the damage as related to transaction execution quality. The protocol did not report a separate stolen-asset incident in the disclosure.

Automatic compensation and a bounty for reporting

Relay paid a $50,000 bounty to @Outputlayer, the account that discovered and reported the API problem. The protocol will also send about $312,000 in compensation directly to affected user wallets, without requiring users to file separate claims.

For users, the key point is that the protocol set a direct remediation path instead of leaving compensation to individual requests. Relay said it will continue improving execution quality and privacy protection along the transaction path. The incident also shows why cross-chain tools need to treat pending transaction data as sensitive infrastructure, not just routine API information.