Across Protocol Halts User Activity Amid Wallet-Draining Reports

Cross-chain bridge Across Protocol told users on Tuesday to stop accessing its app and connecting wallets while it investigates a potential security incident affecting its domain. The protocol advised users against signing transactions or granting approvals until further notice. It did not specify the nature of the incident, nor confirm whether its website had been compromised — an omission that leaves the attack vector unresolved.

Across enables transfers of digital assets between Ethereum and other blockchain networks. The warning, published in a post on X, did not include a timeline for restoration. Until the operator publishes findings, users cannot distinguish between a compromised front-end, a malicious approval flow, or a narrower configuration failure; each scenario carries a different remediation path.

What have users actually lost?

On-chain claims posted to X point to concrete but unverified losses:

• One user claimed a loss of $9,000 in USDC — roughly the median monthly US household income, wiped out in a single interaction.
• A second user reported losing 7,053 USDT0 across seven transactions on the Plasma blockchain, an average of just over $1,000 per transaction.
• A third user said their wallet was drained after using the bridge several times, alleging the website itself had been compromised.

Across asked the affected users for transaction details so it could investigate their reports. Cointelegraph, which first reported the story, has not independently verified the claims. Across Protocol did not immediately respond to a request for more details. In plain words: the losses are alleged, the totals are small by exploit standards, and the protocol has confirmed only that it is looking.

Is this an isolated incident?

The warning follows a separate disclosure by NEAR AI on Monday. In a November 9 incident report, the company said attackers exploited a remote code execution vulnerability in SGLang, an open-source AI inference engine, to access an internal server and additional infrastructure.

The breach exposed account details belonging to approximately 100 users and data from 18 AI agents. The compromised material included user names, email addresses, agent chat histories, settings and logs. Two customers had API keys exposed. NEAR AI said the attackers may also have observed requests processed on the compromised server, including those running in confidential mode — meaning data users explicitly expected to remain private may have been read.

The company said it has patched the vulnerability, revoked the exposed credentials and restored access to its cloud services. The two episodes are unrelated in infrastructure and scale, but they land within a single week.

What should bridge users watch now?

For Across users, the operational exposure sits in outstanding token approvals. Even users who have not lost funds may carry active approvals on Ethereum or connected chains; the protocol's advice against signing anything suggests it cannot yet rule out that malicious approval requests are live. Users who interacted with the app recently should audit their approvals directly through their wallets rather than through any link shared in social replies, a common secondary scam vector after public incidents.

For NEAR AI, the damage is informational rather than financial: names, emails and chat histories of roughly 100 users are now in attackers' hands, and two API keys require rotation wherever they were reused. The company has not disclosed whether it observed post-breach abuse of the exposed credentials; that silence is itself a data point.

Across has set no deadline for its investigation. The credible near-term milestone is a technical post-mortem identifying the compromise vector and a confirmed safe front-end; until both arrive, the protocol's own guidance remains the operative instruction — do not connect, do not sign, do not approve.