Across Halts Website and API After Nov. 10 Domain Hijack

By Tom Whitfield

At about 1:45 p.m. ET on Nov. 10 (18:45 UTC), attackers took control of Across’s domain and placed a phishing page. The cross-chain protocol then suspended its website frontend and API. The team began disabling the site within 15 minutes of receiving an alert.

The announcement did not disclose a monetary loss, victim count or shortfall in user funds. Instead, Across separated potential exposure by access path and gave affected visitors one remediation instruction.

Who may have been affected?

Across said visitors who reached the phishing page before it was blocked "may have been affected." The project pledged to "compensate them in full." Affected users should connect the wallet used at the time to Revoke.cash.

The instruction applies specifically to permissions granted that day, not every historical approval. Across identified no individual wallet, transaction or loss amount. Its compensation pledge therefore covers a group the announcement did not quantify.

That distinction is operationally narrower than a blanket account-compromise warning. Only visitors who reached the phishing page during the live exposure window were directed to inspect same-day permissions. Across did not publish when Cloudflare removed the domain’s DNS records.

Who was not affected?

People who accessed the website before the attack were not affected, Across said. The same applied to users of its API and third-party integrations. By the announcement, the phishing page was already inaccessible.

These exclusions define the stated incident perimeter. Pre-attack visitors and integration clients sit outside the warning, while people who reached the phishing page before blocking may need remediation. Across did not say whether any customer funds moved through the phishing page.

How did the takeover occur?

Across attributed the domain takeover to social engineering targeting Namecheap, the domain registrar. The announcement did not describe the pretext or explain how registrar controls were obtained. It identified no smart-contract failure.

The team received an alert and began disabling the site within 15 minutes. SEAL911 helped major wallets flag the domain as a phishing site. Cloudflare removed its DNS records.

SEAL911’s wallet warnings and Cloudflare’s DNS removal addressed two separate controls: user recognition and domain routing. Across had not completed its root-cause investigation. The two interventions nevertheless made the phishing page inaccessible by the time the project issued its announcement.

Why is the API still offline?

Across will keep the frontend and API offline until it confirms the domain is secure. Despite finding no impact on API and third-party integration users, the project announced no partial restoration. The stated release condition is a security confirmation, with no restart deadline attached.

For automated clients, the immediate consequence remains endpoint unavailability during containment. Across said those integrations were not affected by the phishing exposure. Their operations nevertheless cannot use the suspended endpoint until the project completes its stated security check.

Across also said it was investigating how the domain was taken over. It plans to publish a review when it has more information. No review date or compensation-claim procedure appeared in the announcement.

What happens next?

The next firm checkpoint is confirmation that the domain is secure. Until then, both the frontend and API remain offline. Visitors who reached the phishing page should use Revoke.cash with the same wallet connected during the incident to revoke permissions granted that day.

The compensation pledge remains open-ended because Across gave no count of affected visitors. Its next scheduled disclosure is the promised review, although the project attached no publication date. Service restoration remains tied to security confirmation rather than a fixed calendar deadline.