AcrossProtocol Offline After Namecheap Social-Engineering Attack

By Elena Vasquez

AcrossProtocol’s website and app remained unavailable after an unauthorized party gained control of its domain through a social-engineering attack targeting registrar Namecheap, according to the protocol. The team shut down the website within minutes after unauthorized access was established, but the disclosure provided no restoration date, investigation timetable or quantified user loss.

What does the registrar compromise change?

A domain registrar manages the web address users rely on to reach a service. In this case, the disclosed compromise gave an unauthorized party control of that address, and Cloudflare and SEAL911 helped block a phishing site.

AcrossProtocol facilitates transactions across blockchain networks. The practical effect is blocked access through the web entry point, not a disclosed failure of cross-chain transaction logic.

How large is the disclosed impact?

The source did not quantify losses, report an affected-user count, or tie financial damage to the phishing site. It also named neither a blockchain network nor a token standard, leaving no basis for measuring asset-specific exposure.

The source does not establish an on-chain loss, so the scale of harm cannot be inferred from the site takedown alone. For now, the verified scale is an offline service, not a quantified loss.

How did responders contain the incident?

AcrossProtocol said Cloudflare and SEAL911 helped by flagging the domain as at risk and blocking a phishing site. Their role, as described, was assistance with containment rather than recovery; the update did not say that either company restored the app or completed forensic work.

The team said it was securing the domain and investigating while keeping the website disabled. That sequence puts containment ahead of availability, although no deadline or assurance of a clean restoration accompanied it.

The known result is a blocked phishing site and an offline entry point, not a documented resolution.

What should affected users do?

AcrossProtocol advised users to avoid accessing the app “until further notice.” It also asked people affected by the phishing incident to “revoke permissions granted to suspicious integrations.”

• Keep away from the app until the protocol issues further notice.
• Revoke permissions granted to integrations users regard as suspicious.

Revoking permission removes the access a user previously granted to an integration. The source did not identify particular integrations, describe the revocation process or name affected users, so users must assess permissions individually rather than assume every connection was malicious.

The protective step is to limit access and remove permissions where users have a concrete reason to distrust an integration.

What remains unresolved?

The disclosure did not identify the attacker, explain how social engineering succeeded at Namecheap, or say whether registrar credentials were obtained. It also cited no independent forensic findings, identified no individual suspect or victim, and did not explain whether any funds moved.

For users, that uncertainty matters because a restored website would not by itself establish that suspicious permissions had been contained. A credible resolution would need AcrossProtocol to explain the registrar compromise, the phishing site and any connection to user-approved integrations.

AcrossProtocol also did not set a date for restoring the website, returning the app or publishing a post-incident report. The next verifiable checkpoint is therefore operational recovery, supported by a clearer account of scope and remediation.

With no restoration date set, the containment window remains open, and users should continue treating the web interface as unavailable until AcrossProtocol confirms recovery.