Across Protocol Restores Domain After Phishing Hijack Drains $350K

Cross-chain bridge Across Protocol has restored its website after a November 10 domain hijacking that security firm GoPlus estimates drained approximately $350,000 from user wallets across six blockchain networks. The protocol attributed the takeover to a social engineering attack against domain registrar Namecheap, not to any flaw in its smart contracts.

In a Wednesday update, Across confirmed its domain was back under its control and all systems were operating normally. The team promised restitution. "All affected users will be made whole. We'll share a full post-mortem in the coming days," Across stated. No date accompanied that commitment, and Across has not disclosed its own confirmed loss figure or the number of affected users; the $350,000 estimate comes solely from GoPlus.

How did the attackers take control?

The incident began at approximately 18:45 UTC on November 10, when an attacker gained unauthorized control of the Across domain. Rather than exploiting the bridge itself, the attacker manipulated the website's domain settings and redirected visitors to a phishing page built to resemble the legitimate service. The attack targeted infrastructure, not code.

Across said it received an alert within 15 minutes and immediately moved to shut down the compromised website. Security response group SEAL911 helped flag across.to as a phishing site with major cryptocurrency wallets. Cloudflare then classified the domain as dangerous and removed its DNS records, blocking access to the fraudulent page. Across temporarily suspended its frontend and API services during recovery.

The registrar's role shifted over the course of the incident. Across initially said Namecheap had not responded to its requests for assistance; its subsequent announcement thanked Namecheap founder Richard Kirkendall for helping secure the account and opening an investigation. Across maintained its domain had been protected by established security controls and said the circumstances of the takeover would be examined in its post-incident report. That examination has not yet been published.

What did the phishing page actually steal?

GoPlus estimated losses on Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma. Users who interacted with the fake page may have signed EIP-2612 permits, Permit2 authorizations or direct token approvals. These permissions let an approved spender move tokens without the owner authorizing each transfer. Some victims may also have sent funds directly to attacker-controlled addresses.

GoPlus identified several suspicious spender addresses and advised users to review permissions granted during the attack window. Across directed users who connected wallets on November 10 to Revoke.cash to review and revoke authorizations. Revocation blocks future transfers but cannot reverse transactions already completed. Users who signed malicious permits face additional risk, because off-chain signatures can remain usable even when they do not appear among ordinary token approvals.

Across stated that users who visited its website before the attack were unaffected, as were API users and third-party integrations. The team asked affected users to contact its official account with wallet addresses and transaction hashes, while warning against unsolicited messages from impersonators. Temporary browser and wallet phishing warnings may persist after restoration, the protocol said.

Is this part of a wider pattern?

The attack fits a broader sequence of DeFi website compromises. On October 31, security firm Blockaid identified at least 12 websites serving the Step Drainer phishing toolkit, including Flap, which confirmed a DNS attack had redirected visitors. A separate October incident involving compromised API credentials let attackers send fraudulent messages that appeared to come from hardware wallet manufacturer Foundation; Foundation said its communication infrastructure was affected but customer wallets and funds were not.

The November incident is also distinct from a July breach involving Across's Risk Labs-operated relayer on Solana, when attackers fabricated 1,627 deposit events with a stated value of $41.7 million. The relayer processed 581 fraudulent requests before suspending operations, producing a net loss under $4 million after accounting for trapped attacker funds. July's attack hit the relayer; November's hit the domain and visitors' wallet permissions.

Across remains among the busiest cross-chain bridges, with DefiLlama recording approximately $5.9 billion in transfers over the preceding 30 days. The investigation is ongoing, and the promised post-mortem on the domain takeover is expected in the coming days, though no firm deadline has been set.