Across Takes Front End Offline After Domain Takeover via Namecheap

Cross-chain protocol Across has taken its website and API offline after attackers seized control of its across.to domain through a social-engineering attack aimed at its registrar, Namecheap. The takeover began at approximately 1:45 p.m. ET on Tuesday, or 18:45 UTC, according to the protocol's own account of the incident.

Across said its team received an alert within 15 minutes of the incident and immediately began shutting down the site. That response window — a quarter of an hour from compromise to detection — is short by incident-response standards, though the protocol has not said how many users actually visited the hijacked domain during that period.

The company said some people who visited across.to may have been affected. Users of third-party integrations and the API were not exposed, according to the protocol's statement. That distinction matters: it suggests the attack surface was limited to the front end rather than the underlying cross-chain infrastructure.

What is the known damage?

No figure exists yet. Across has not disclosed a loss amount, and until on-chain forensics or user reports establish a number, the scale of any losses remains unknown. The protocol said it plans to compensate all affected users — a commitment that, at present, has neither a stated cap, a claims process, nor a timeline attached to it.

The protocol urged anyone who visited the site during the incident to revoke related approvals through Revoke.cash, a standard tool for removing token allowances. That instruction implies the phishing page may have solicited approvals or signatures from visitors, though Across did not describe the mechanics of the fraudulent page in detail.

How was the attack contained?

Two external parties intervened. SEAL911, a security response service, flagged across.to as a phishing site. Cloudflare, the domain's DNS provider, then removed the domain's DNS records entirely, leaving the site inaccessible.

The removal of DNS records is a blunt instrument: it blocks the phishing page, but it also blocks the legitimate site. Across said it plans to keep both its front end and API offline until domain security at the registrar level is restored. The protocol did not estimate when that restoration would occur.

Why the registrar is the weak link

The incident did not involve a flaw in Across's own contracts or infrastructure, according to the protocol's account. Instead, attackers reportedly manipulated Namecheap, the registrar, through social engineering — a human attack rather than a technical one.

This class of attack is difficult for protocols to defend against directly, because domain control sits outside their systems. A protocol can audit its smart contracts, yet its front end remains reachable only through a domain whose custody depends on a registrar's internal procedures. Across has not said what changes, if any, Namecheap has committed to, or whether the registrar has acknowledged the breach.

Namecheap did not provide a statement included in the protocol's disclosure. The absence of the registrar's account leaves open questions about how the social engineering succeeded and whether other domains at the same registrar face similar exposure.

What happens next

Across faces three immediate tasks before it can safely restore service: regain verified control of the domain, confirm that registrar-side vulnerabilities are closed, and stand up a compensation process for affected visitors. The protocol has promised to make users whole, but no claims mechanism, deadline, or compensation ceiling has been published.

For users, the operational guidance is narrow and concrete: anyone who connected a wallet to across.to during the incident window should review and revoke approvals. Until Across restores its domain and publishes a loss figure, the actual cost of this attack — and the credibility of the compensation pledge — cannot be assessed.