Across Regains Hijacked Domain, Praises Full Compensation for Affected Users

Cross-chain bridge protocol Across says it has recovered its official domain after a hijacking, and that its systems are running normally again. The protocol committed to fully compensating every user affected by the incident. It has not disclosed the total number of affected users or the financial scope of losses.

The recovery follows an initial advisory in which Across warned users to stay away from the application, avoid wallet connections, and refrain from signing transactions or authorizations on the site until further notice. That guidance, issued while the domain was under hijacker control, reflected the standard risk profile of DNS-level takeover incidents: a spoofed front end can harvest signatures and drain wallets even when the underlying smart contracts remain uncompromised.

Who flagged the hijack?

Across said the white-hat security group SEAL 911 helped flag the hijacked domain as a phishing site. The protocol also credited the founder of registrar Namecheap with assisting in securing its account and supporting the investigation. The investigation remains underway, according to the project's statement.

The involvement of a registrar executive points to the incident's likely vector. Domain hijackings typically exploit account access at the registrar level rather than weaknesses in the protocol's on-chain infrastructure. Across operates as a cross-chain protocol, meaning its core business — relaying transfers between blockchains — depends on users trusting its web front end as the entry point to its contracts.

What happens next for affected users?

Across said it will fully compensate every user affected by the domain incident. It has not detailed the compensation mechanism, eligibility criteria, or a timeline for payouts. The protocol plans to release a full incident analysis in the coming days, but has not detailed the cause of the hijacking or the incident's full scope.

For users who interacted with the site during the takeover window, the operational takeaway remains caution. Across's own advisory defined the risk actions precisely: wallet connections, transaction signing, and authorization approvals on the affected domain.

Why domain security matters for DeFi front ends

The incident underscores a recurring structural weakness in decentralized finance operations. Even protocols with audited smart contracts present a centralized attack surface at the domain and hosting layer. When that layer fails, users cannot distinguish a legitimate interface from a phishing replica, and losses occur before any on-chain defense can engage.

Across has not stated whether it will implement additional registrar-level protections, such as registry locks or multi-party domain administration, as part of its remediation. The full incident analysis expected in the coming days will be the project's next accountability checkpoint. Until that report lands, the cause, scope, and compensation process for the hijacking remain officially undocumented.