Across Protocol Domain Hijack Drained $305,000 From Aave Depositors

An attacker extracted roughly $305,000 from Aave depositors on Nov. 10 after hijacking the Across Protocol website through a social-engineering attack on the domain registrar Namecheap, according to blockchain analytics firm Bitquery and statements from Across Protocol.

The largest single loss involved aWETH, an interest-bearing Aave token that represents a staked ether deposit and can be transferred by its holder. Aave's own documentation confirms that a signed permit message can authorize another account to spend those tokens — the mechanism the attacker exploited.

How did the drainer get the tokens?

Bitquery's on-chain reconstruction shows the spoofed Across website prompted visitors to sign a permit approval rather than a direct transfer. The attacker then used that permission to move the depositor's aWETH, which also placed the victim's separate lending position within reach.

The first transaction on Nov. 10 recorded an unlimited approval, followed by approximately 115.23 aWETH sent to one wallet and 28.81 aWETH to another. Bitquery identifies the recipients as the attacker's wallet and a drainer fee wallet, a split consistent with an 80/20 arrangement between operator and tooling provider.

The victim's transfer history shows four successive pulls ending three minutes after the first. The owner revoked the approval one minute after the final pull, according to Bitquery — a response measured in minutes, but still too late to stop the outflows.

Why did the loss figure change?

The confirmed tally rose on Nov. 12 when investigators identified a separate sweep of 26.38 ETH from a second victim, valued by Bitquery at roughly $54,000 at the time of the transaction. Ethereum records show that victim's ether left on Nov. 10, the same day as the aWETH drains.

The revised figure also corrects a widely circulated $294,000 estimate. Bitquery says that number simply matched the holdings of the drainer's fee wallet and included funds that predated the Across attack — meaning the earlier estimate conflated old balances with new proceeds.

The attribution itself carries a caveat. Bitquery links the drains to the Across incident through timing and shared recipient wallets, while acknowledging that blockchain records cannot show which website a victim actually visited. The connection is inferential, not proven by the chain itself.

What has Across promised?

Across Protocol said it regained control of the domain on Nov. 11 and pledged to make affected users whole. The protocol also committed to publishing a postmortem of the incident.

Those commitments remain promises until funds move and the report appears. Neither a reimbursement timeline nor a total compensation figure has been disclosed.

What does the incident expose operationally?

The attack did not exploit a flaw in Aave, in the aWETH token standard, or in Across's contracts. It exploited the registrar layer: control of a domain at Namecheap was transferred through social engineering, and the fake front end then weaponized a legitimate DeFi feature — permit-based approvals — against depositors.

For protocol operators, the incident illustrates that front-end integrity is only as strong as the weakest link in domain administration. For users, it shows that permit signatures carry the same weight as on-chain approvals, and that revocation after an attack is a recovery step, not a defense.

The practical defense is pre-emptive: users can revoke standing approvals on token dashboards before an incident, since the Nov. 10 victim's revocation arrived after every dollar had already left.

The postmortem and the reimbursement now carry the weight of the story. Until Across publishes both, affected users have a pledge and no dates.