Across Restores Systems After Domain Hijack; $350,000 Estimated Lost

Marcus Bennett

Across restored its website on Wednesday after a Nov. 10 domain takeover that redirected visitors to a phishing site and caused an estimated $350,000 in user losses, according to security platform GoPlus.

At about 18:45 UTC on Nov. 10, attackers gained control of Across's official domain through social engineering against its registrar, Namecheap, Across said in a post on X.

How did the domain takeover unfold?

A visitor seeking the official Across site instead reached a page asking wallet holders to sign fake token approvals or permits. GoPlus said the prompts were designed to drain users' wallets.

Across did not disclose the number of affected users or provide a loss estimate. GoPlus put total user losses at $350,000. The affected wallets were on:

• Ethereum
• Arbitrum
• Base
• BNB Chain
• Ink
• Plasma

Across said it received an alert within 15 minutes of the takeover and began taking the site offline. Security response group SEAL911 flagged the domain as phishing with major wallet providers. Cloudflare marked the domain at risk, then removed its DNS records and made the phishing site inaccessible.

Later on Wednesday, Across announced that Namecheap had helped it regain control. The protocol restored all systems to normal operations and said all affected users "would be made whole." It did not disclose the reimbursement mechanics or timing.

What does the restoration change for users?

The immediate change was operational. Across had restored its official site, and the malicious DNS records were gone. Its promise to reimburse affected users also means GoPlus's $350,000 estimate represents stolen funds, not necessarily the users' final net loss if the company fulfills that commitment.

The reported entry point was social engineering at the registrar, not an exploit of the crosschain protocol. That distinction matters for risk assessment: web-domain control could redirect users toward malicious signatures without requiring a failure on any of the listed chains. Namecheap's assistance mattered because registrar control determined where the official domain resolved.

No count of victims or amount-by-chain breakdown was available. The $350,000 estimate therefore cannot show whether the loss came from many small thefts or a few large drains.

What else failed in the same security window?

Arcus, a decentralized exchange, reported a separate loss on Tuesday. It said an accounting bug allowed one account to record a larger balance than it actually held. An exploiter then withdrew around $2.23 million in USDG stablecoins.

The exploiter requested another $3 million in withdrawals, but a rate limit on Arcus's bridge prevented them. Arcus said no other user accounts were affected. The company treasury fully covered the temporary shortfall, containing the accounting mismatch without shifting it to other users.

The two incidents required different controls. Across relied on registrar cooperation, wallet-provider warnings and DNS removal after phishing. Arcus used its bridge's rate limit to stop a follow-on withdrawal and its treasury to absorb the discrepancy.

On Tuesday, Sui-native hardware wallet project Suiball also announced its closure. The Sui Foundation decided that backing the project was too risky because of a recent wave of attacks on crypto hardware wallets.

These cases followed a surge in security breaches and phishing campaigns accelerated by AI tools that enable faster and more sophisticated attacks. DeFiLlama data showed $8.78 billion lost across 341 crypto hacks and exploits year to date in 2026, led by a $6.36 billion breach at Binance.

That total covers a wider set of incidents than Across, Arcus and Suiball. It should not be read as their combined losses. The contrast remains useful: domain control, exchange accounting and hardware-wallet sponsorship each created a different control problem, while rapid infrastructure responses, withdrawal limits and treasury reserves limited the damage.

No public remediation deadline was disclosed. The next checkpoint is whether Across specifies how it will reimburse users and what registrar safeguards it will put in place, and whether Arcus can preserve the bridge rate limit that blocked the second withdrawal.