Across Protocol Reclaims Domain After Namecheap Social Engineering Attack

Cross-chain bridge Across Protocol says it has regained control of its website after attackers hijacked its domain on Tuesday through a social engineering attack targeting registrar Namecheap, redirecting visitors to a phishing site that drained some user wallets.

In a post on X on Wednesday, the team confirmed the across.to domain is back under its control with help from Namecheap founder Richard Kirkendall, and that all systems are now working normally. "All affected users will be made whole. We'll share a full post-mortem in the coming days," the team said.

The total losses and the number of affected users have not been disclosed. Across first warned users on Tuesday to avoid its app amid reports of drained wallets.

How did the attackers take the domain?

The takeover didn't involve a smart contract flaw or a bridge exploit. In an earlier update, Across said a social engineering attack on Namecheap, its domain registrar, gave the attacker control of the domain at approximately 18:45 UTC on Tuesday.

The team said it was alerted within 15 minutes and immediately moved to shut the website down. The response drew in outside help quickly:

• Security response group SEAL911 flagged the domain as phishing with major wallet providers.
• Cloudflare marked the site as at risk and later removed its DNS records entirely.

Some users who visited the domain before the malicious site was fully blocked may have been affected, according to the team. Third-party integrations and API users were unaffected, which limits the operational blast radius to front-end traffic rather than the bridge's settlement layer.

That distinction matters for a protocol of Across's size. The incident hit one of the largest cross-chain bridges by trading activity: Across ranked third by 30-day transfer volume, behind Circle and LayerZero, according to DefiLlama, having processed roughly $5.9 billion over the period.

What does this mean for infrastructure security?

The attack vector points at a weakness outside blockchain entirely. Domain registrars remain a single point of failure for DeFi front-ends, and a successful social engineering call at Namecheap was enough to compromise a bridge handling billions in monthly volume — no key compromise or code exploit required.

It's a repeat of a familiar pattern in crypto security: the protocol held, the identity layer around it didn't. DNS and domain-level attacks sidestep audits, bug bounties and on-chain defenses, and they put wallet providers and infrastructure firms like Cloudflare in the first-responder role rather than the protocol itself.

For integrators, the episode is a reminder that "unaffected" API traffic and compromised front-end traffic can diverge sharply during an incident. Across's quick takedown — inside roughly 15 minutes — likely capped the damage, but the gap between hijack and full blocking was still enough to reach some users.

What happens next?

Across has committed to compensating every affected user and publishing a full post-mortem "in the coming days." That report will need to answer two questions the team hasn't yet addressed: how much was stolen, and exactly how the social engineering attack on Namecheap succeeded. Until the loss figures and registrar-side details land, the dollar cost of a 15-minute window on a $5.9 billion-per-month bridge remains the open number to watch.