Across Tells Users to Avoid Its App Amid Domain Investigation

Across, a cross-chain protocol, warned users on Nov. 11 to stay away from its application entirely while it investigates a problem involving its domain. The instruction is unusually broad: don't visit the app, don't connect a wallet to it, and don't sign anything through it until the protocol says otherwise.

The warning, issued by Across itself, covers two distinct categories of risk. The first is wallet connections. The second is signatures — and here the protocol drew a line between transaction signatures, which move funds, and authorization signatures, which grant permissions. Across told users to avoid both, and it named wallet connections as a separate activity to steer clear of, apart from signing anything at all.

There's a reason that distinction matters. In cross-chain and DeFi contexts, authorization signatures — the kind used for token approvals and spending permissions — are a common attack vector. A user can grant a malicious contract sweeping rights over their wallet without any funds moving at that moment. That's why protocols under domain-related stress typically tell users to refuse every signature prompt, not just transfers.

Across framed the restriction as open-ended. The caution remains in place until the protocol issues another notice, and the company said it is investigating the domain problem and will provide updates. It did not specify when those updates will arrive.

What exactly did Across tell users to stop doing?

The notice names three activities:

• Visiting the application at all, regardless of whether a wallet is involved.
• Connecting a wallet to the app.
• Signing any transaction or authorization request routed through the application.

That first item is the strictest part. Across didn't ask users to be careful with the app — it told them not to access it. The warning remains tied to the domain investigation the protocol named, and the scope of the notice covers the protocol's domain and its app together.

Why does a domain problem trigger this level of caution?

The protocol's own notice doesn't detail what's wrong with the domain, and Across hasn't described the nature of the issue beyond saying it is investigating. But the shape of the warning speaks for itself. When a project tells users to avoid signing anything through its own front end, the operational concern is that the interface users reach may not be the interface Across controls.

For a cross-chain protocol, that's a serious exposure. Across's core business is moving assets between blockchains, which means its users routinely sign high-value transactions and bridge approvals. Any window in which the app's domain can't be trusted is a window in which every one of those signatures carries risk.

Across has given no timeline for resolution. The restriction stands until the protocol publishes a further update, and until that notice arrives, the working assumption for users is simple: no visits, no wallet connections, no signatures of any kind through the app.