Across Restores Site After Registrar Attack, Promises Full Repayment

Across said it had completely restored its systems and would fully reimburse every user affected after social engineering at its domain registrar redirected visitors from its official website to a phishing page. The company attributed both the temporary website shutdown and its repayment pledge to the same domain-related incident, according to its recovery update.

What happened at the registrar?

Across traced the disruption to social engineering aimed at its domain registrar. The incident changed the destination of the company’s official web address, sending visitors to a phishing site. Across took the website offline before announcing that the systems were working again.

The source places the disclosed failure at the registrar relationship rather than describing a software exploit inside the cross-chain platform. It does not name the registrar or establish how long the redirection remained active.

The announcement also leaves open how social engineering altered the destination. Without the registrar identity, attack timeline or remediation record, outsiders cannot independently assess the intrusion’s path or persistence.

Takeaway: Across identified a registrar-level social-engineering incident, removed the affected website and later declared service restored.

What does full reimbursement cover?

Across said the reimbursement covers all users affected by the incident and described the repayment as full. The company did not state a dollar amount, token amount, payment date, eligibility test, claim process or monetary cap. Nor did it quantify the harm from which users would be repaid, leaving the pledge’s scale unmeasurable from the announcement.

The commitment is more specific about scope than mechanics. Across promises full repayment, but the statement gives users no procedure for proving an incident connection, calculating a loss or receiving payment. It also does not say whether claims require documentation, review or approval.

For Across, which describes itself as a cross-chain interoperability platform, the statement supports a narrower conclusion: it documents disruption to an official web property, not a quantified failure of protocol activity. Any stronger claim about a protocol outage would go beyond the source.

Takeaway: The repayment promise covers all affected users, but the announcement does not provide the terms needed to estimate or claim it.

What remains undisclosed?

The recovery update gives no incident date, attack duration, victim count, registrar name or technical post-mortem. It identifies no law-enforcement agency, court filing, on-chain transaction, or named executive making the statement. Those omissions prevent independent verification of the incident’s scale and the basis for determining which users qualify for reimbursement.

Across has nevertheless stated two firm outcomes: systems were working again, and affected users would receive full reimbursement. Those statements describe the company’s position after the shutdown; they do not independently confirm that every user interaction remained safe or that the registrar had closed the attack route.

The announcement also provides no timeline for post-incident monitoring, which matters because a restored website does not by itself establish remediation at the registrar. No claim about the registrar’s controls, however, should replace the documented facts: a phishing redirect, a temporary closure and a full-reimbursement promise.

Takeaway: The restoration and reimbursement commitments are clear; the attack’s cause, reach and containment remain unverified beyond Across’s account.

The immediate checkpoint is publication of reimbursement terms, any claims deadline and registrar remediation; absent those disclosures, affected users have no stated payment timetable or verification deadline.