Across Restores Site After Domain Hijacking, Pledges Reimbursement

Across said on Nov. 11 that it had fully restored its systems after its official website displayed a phishing page. The cross-chain interoperability platform attributed the hijacking to social engineering targeting its domain registrar. It also said it planned to fully reimburse affected users, although the source reported no completed payments.

Across took the website offline earlier on Nov. 11, according to its update. The platform described the restoration as complete and said: “systems are now fully restored.” The notice offered no restoration logs, independent assessment or detailed account of the registrar compromise.

What changed after the domain hijacking?

The affected site was Across’ official online destination, not a peripheral support page. The shutdown blocked normal use of that destination after it displayed phishing content, but the source gives no duration for either condition.

The later restoration claim addresses the reported website outage. It does not establish whether attackers obtained user credentials, accessed accounts or caused a protocol transaction to fail. Across reported no visitor counts, user reports or confirmed financial-loss figure.

For users, the relevant questions are whether a visit reached fraudulent content and whether resulting claims can be documented. Across’ notice answers neither point, leaving restoration and loss verification as separate workstreams.

The website outage reportedly ended, but the scale and consequences of the phishing exposure remain unmeasured.

What does the reimbursement pledge establish?

Across presented compensation as its next response, saying it “plans to fully reimburse users affected by the incident.” That wording establishes an intention, not a completed payment program. The source gives no dollar amount, eligibility rules, claim procedure, payment method or completion date.

The word “fully” describes the promised scope, not a disclosed loss total. Without that total or an affected-user count, readers cannot estimate the cash obligation or determine how many claims the pledge covers. The pledge also prevents assessment of Across’ financial exposure because neither compensation costs nor the size of the incident appear in the notice.

The commitment nevertheless changes the operating response: compensation now forms part of Across’ remediation plan. It still leaves the company without disclosed mechanics for executing that commitment.

Full reimbursement is therefore a promise without disclosed terms, timing or evidence of payment.

What remains unsaid?

The notice names no registrar, law-enforcement agency or regulator, and the source provides no year for the Nov. 11 incident. It does not explain how the domain was altered, whether credentials were obtained or whether an outside forensic review occurred. It also discloses no exploit size because it describes social engineering rather than a technical exploit.

Nor does the source identify any chain, token standard, contract or protocol failure. Phishing content alone does not establish that funds were stolen, and the absence of a loss figure cannot be treated as evidence that no loss occurred. The defensible conclusion is narrower: users faced a phishing page displayed through Across’ official domain, while the platform says its systems have recovered.

The public account identifies social engineering as the cause, but leaves the attacker, technical pathway and financial loss undocumented.

What happens next?

Across has disclosed no reimbursement deadline and no independent report validating the restoration. The next verifiable checkpoint is evidence that eligible users can receive funds under published terms, rather than another general statement that systems work.

If the company identifies the registrar, discloses the number of affected users and publishes payment records, the incident can be assessed more precisely. Until then, the supported description remains a restored official website attached to an unfulfilled compensation pledge.

Reimbursement execution is the next test, and Across has disclosed neither a deadline nor an amount.