Across Protocol Restores Site After Domain Hijack Through Namecheap

Across Protocol has restored its website after a social engineering attack on its domain registrar, Namecheap, gave an attacker control of the across.protocol domain at approximately 18:45 UTC on Tuesday. The team has not yet disclosed total losses or the number of affected users.

The incident forced Across to warn users on Tuesday to avoid its app amid reports of drained wallets. Some users who visited the domain before the malicious site was fully blocked may have been affected, the team said. Third-party integrations and API users were unaffected.

How the attack unfolded

Across said it was alerted within 15 minutes of the takeover and immediately worked to shut the website down. The speed of the response limited the exposure window, but did not eliminate it entirely.

Two external parties moved quickly to contain the damage:

• SEAL911, the security response group, helped flag the domain as phishing with major wallet providers, reducing the chance that browser extensions and wallets would interact with the malicious site.
• Cloudflare marked the domain as at risk and later removed its DNS records entirely, cutting off resolution of the hijacked address.

The attack vector matters for practitioners. Across did not suffer a smart contract failure or a key compromise on its own infrastructure. The attacker exploited the weakest link in the chain: the registrar. Control of a domain at the Namecheap level means control of DNS, which means the ability to serve a lookalike front end that prompts users to sign malicious transactions. No bridge code needs to be broken.

What does this change for bridge users and integrators?

For end users, the incident is a reminder that a bookmarked URL is not a guarantee of safety if the underlying domain is hijacked at the registrar. Wallet-level phishing flags, such as those coordinated through SEAL911, are currently the fastest defensive layer available.

For third-party integrations and API users, Across confirmed no impact, a meaningful distinction because it separates the domain-facing front end from the protocol's programmatic surface. The bridge contracts themselves were not compromised in this incident, according to the team's account.

The protocol's scale raises the stakes. Across is one of the largest cross-chain bridges by trading activity. According to DefiLlama, it ranked third by 30-day transfer volume, behind Circle and LayerZero, having processed approximately $5.9 billion over the period. That figure works out to roughly $197 million per day moving through a bridge whose primary user interface was, for a window on Tuesday, under an attacker's control.

The unanswered questions

Two figures remain outstanding: the total value drained from affected wallets and the number of victims. Across has said both are not yet disclosed, which typically means the team is still tracing on-chain transactions tied to the malicious front end. Users who connected wallets during the exposure window should assume their signatures may have been captured and review approvals granted at that time.

The registrar layer has now produced at least one high-profile incident affecting a top-three bridge by volume. Whether Namecheap tightens its account-recovery procedures, or whether protocols migrate to registrars with hardware-enforced transfer locks, is the operational question the industry will be watching in the coming weeks.