Revised Trace Ties $304,500 Aave Loss to Across Domain Hijack

A revised on-chain trace links a single depositor's transfer of $304,500 in Aave WETH deposit tokens to the Nov. 10 hijack of the Across Protocol website, lifting total estimated losses from the incident to $401,900 across nine wallets.

The trace, built from on-chain records, covers wallets on Ethereum, Arbitrum, Base, BNB Chain and Optimism. It places the transfers between 2:02 p.m. and 4:53 p.m. ET on Nov. 10, valuing the assets at the moment they were taken. Across has not published a loss total of its own.

What does the revised figure show?

The analysis attributes 148.60 Aave WETH deposit tokens (aWETH) — valued at $304,500 when transferred — to one depositor. That single wallet accounts for roughly 76% of the revised estimate.

The aWETH left the depositor's wallet in four pulls executed over about three minutes, after the attacker used a spending permit. The first transaction hit the chain at 3:09:23 p.m. ET (20:09:23 UTC). On-chain records show an unlimited approval followed by transfers into two wallets.

The trace connects these transfers to the Across incident through two signals: timing and the recipient wallets involved. It cannot establish which website the depositor visited, and it leaves unconfirmed when the off-chain signature that enabled the drain was actually made. The site visit itself remains unconfirmed.

How did the total climb to $401,900?

The revised estimate adds a separate sweep of 26.38 Ether, worth roughly $54,000 at the time of the theft, to an earlier $348,000 tally. About 20.95 ETH from that sweep reached the attacker's wallet within 10 minutes.

The numbers break down as follows:

• $304,500 — one depositor's aWETH transfer, the largest single loss
• $54,000 — the 26.38 ETH sweep added in the revised tally
• $401,900 — the new floor estimate across nine wallets
• Nine — the number of wallets traced across five chains

Across attributed the incident to social engineering at its domain registrar, Namecheap, which handed an attacker control of the protocol's domain at about 1:45 p.m. ET (18:45 UTC) on Nov. 10. On Nov. 11, Across said it had regained control and that its systems were working normally.

What has Across promised?

"All affected users will be made whole," Across said in a statement after regaining control of its domain. The protocol also said it plans to publish a post-mortem.

The pledge is a commitment, not a confirmation. Across has not said that any reimbursements have been paid, and the company has not verified the $401,900 estimate. Until the post-mortem lands, the trace remains the fullest public accounting of the incident's cost.

Was Aave itself exploited?

No. Aave deposit tokens represent assets supplied to the lending protocol, and the trace concerns wallet approvals and token transfers — not a breach of Aave's contracts. The depositor's losses stem from a spending permit granted to the attacker, likely via a malicious signature prompted by the hijacked Across site. The analysis does not establish that Aave's contracts were exploited in any way.

One more caveat matters for anyone sizing the damage. The $401,900 figure is a floor, not a ceiling. The analysis did not cover every chain, and it excluded two stolen tokens that carried no market price. The true total could run higher once the gaps are filled.

Across's post-mortem, whenever it arrives, is the next checkpoint for users waiting on compensation and for a fuller picture of how a registrar-level social engineering attack cascaded into six-figure DeFi losses.