Across Protocol domain hijack: site restored, $350K estimated losses

Editor’s take (Keshav Aggarwal): This domain hijack makes me trust Across Protocol less. I would not use it now, and I’d tell readers to keep their assets in a cold wallet.

Across Protocol domain hijack: the cross-chain bridge said it has regained control of across.to after an attacker seized the domain through social engineering at registrar Namecheap and pointed visitors at a phishing site. Security researchers estimate roughly $350,000 was stolen from user wallets, according to crypto.news, though Across has not confirmed that figure or the number of affected users.

In a Wednesday update, the team said the domain was back under its control and that all Across systems were operating normally. Across thanked Namecheap founder Richard Kirkendall for responding publicly and helping secure the account and open an investigation.

Across Protocol domain hijack: how the takeover unfolded

The incident began at approximately 18:45 UTC on November 10, when an attacker gained unauthorized control of Across’s domain. Rather than touching the bridge’s smart contracts, the attacker manipulated the website’s domain settings and served a page designed to resemble the legitimate service.

According to Across, the team was alerted within 15 minutes and immediately began working to shut the compromised website down. Security response group SEAL911 helped flag across.to as a phishing site with major crypto wallets, and Cloudflare classified the domain as dangerous before removing its DNS records, cutting visitors off from the fraudulent page.

Across temporarily suspended its frontend and API services during the recovery process. The team said users who accessed its website before the attack were not affected, and that third-party integrations and API users were unaffected by the domain compromise.

Why a registrar takeover bypasses DeFi’s security stack

Bridges are usually defended at the contract layer, with audits, multisigs, rate limits and on-chain monitoring. None of that mattered here. The attacker did not need a code exploit, only control of the DNS record that tells a browser where across.to lives. Every wallet connection made during the window went to code the attacker controlled.

GoPlus said visitors to the phishing page could have been persuaded to sign EIP-2612 permits, Permit2 authorizations or direct token approvals, permissions that let an approved spender transfer tokens without the owner authorizing every later transaction. In some cases victims may have been persuaded to send cryptocurrency directly to attacker-controlled addresses. GoPlus identified several suspicious spender addresses linked to the incident and advised users to examine permissions granted during the attack.

Domain-level attacks are stacking up across DeFi

Across is not an isolated case. The Across Protocol domain hijack fits a pattern of registrar-level attacks targeting frontends rather than smart contracts. On October 31, security firm Blockaid identified at least 12 websites serving the Step Drainer phishing toolkit. Those incidents included Flap, which confirmed a DNS attack had redirected visitors from its legitimate website to an unauthorized destination. Registrar-level social engineering appeals to attackers because one successful support exchange can compromise every visitor at once, no matter how well the protocol’s contracts are built.

Data angle: a large bridge, a small third-party estimate

Across is one of the busiest cross-chain bridges. It ranked third by 30-day transfer volume behind Circle and LayerZero, having processed about $5.9 billion over the period, according to DefiLlama. Against that throughput, the roughly $350,000 estimate from security researchers is modest, but it covers only wallets that interacted with the fake site while it was live.

Security firm GoPlus said the phishing operation affected wallets across Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma. Because the $350,000 figure is a third-party estimate and Across has not published its own loss number or affected-user count, the final tally could still move.

Reimbursements and the revocation caveat

“All affected users will be made whole. We’ll share a full post-mortem in the coming days,” Across said on X.

The team directed users who connected a wallet during the attack to Revoke.cash to review and revoke authorizations granted on November 10. Revoking an approval prevents further transfers using that permission but cannot reverse transactions that have already occurred.

Users who signed malicious permits may need to take additional precautions, because some off-chain signatures can remain usable even when they do not appear among ordinary token approvals.

What to watch next

• The post-mortem. Across said its domain had been protected by established security controls and that the circumstances surrounding the unauthorized takeover will be examined in its post-incident report. Which controls failed will matter to every protocol using a similar registrar setup.
• The Namecheap investigation. How the account was accessed, and what verification changes follow at the registrar, is the part of this story that generalizes beyond Across.
• Reimbursement mechanics. Across has promised to make affected users whole but has not said how claims will be verified, on which chains payouts will arrive, or on what timeline.
• Follow-on theft. Permit-based approvals can be exercised later, so the $350,000 estimate may not be the final number.

What users and protocols should check before connecting

Users should treat any wallet connection made during an incident window as compromised until approvals are reviewed: revoke ERC-20 allowances, check Permit2 and EIP-2612 permits, and move remaining funds to a fresh wallet if a signature cannot be cancelled. Bookmarking official domains and reaching apps through independent sources reduces exposure to a swapped frontend.

For protocols, the lesson is that a registrar account is part of the attack surface. Hardware-key multi-factor authentication, registrar lock, alerts on DNS changes and a rehearsed takedown plan with wallet providers and Cloudflare sit outside the audit scope but inside the blast radius of a domain hijack.

Frequently asked questions

What happened in the Across Protocol domain hijack?

An attacker used social engineering against registrar Namecheap to take control of across.to at about 18:45 UTC on November 10, redirecting visitors to a phishing site. Across regained control of the domain the following Wednesday. Security researchers estimate about $350,000 was stolen, a figure Across has not confirmed.

How much was lost and will users be reimbursed?

Security researchers estimate roughly $350,000 was lost in total, and GoPlus said wallets on Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma were affected. Across said on X that "all affected users will be made whole" and promised a full post-mortem in the coming days, but has not disclosed its own loss figure, the number of affected users, or how claims will be processed.

What should users who connected a wallet during the attack do?

Across directed affected users to Revoke.cash to review and revoke approvals granted on November 10. Revoking stops further transfers under that permission but does not reverse past transactions, and some off-chain signatures such as permits can remain usable even when they do not appear among ordinary token approvals.

Sources: crypto.news, Cointelegraph