Across Protocol recovers hijacked domain as user losses reach an estimated $400,000
Cross-chain bridge Across Protocol has restored its website after a social engineering attack on domain registrar Namecheap briefly redirected visitors to a phishing frontend, resulting in an estimated $401,900 in drained user funds.
Cross-chain bridge Across Protocol has fully restored its services after an unauthorized takeover of its official domain, across.to, pointed visitors to a phishing interface on Nov. 10, 2026. The incident occurred at approximately 18:45 UTC after domain registrar Namecheap fell victim to a social engineering attack. Across detected the takeover within 15 minutes, working with SEAL911 to flag the phishing address with major wallet providers and Cloudflare to pull the domain's DNS records.[2][4]
The protocol announced at 01:16 UTC on Nov. 11 that all systems were operational after Namecheap founder Richard Kirkendall helped secure the registrar account. Across emphasized that third-party integrations and API users were unaffected, and the team pledged that all impacted users would be made whole.[1][2][4]
According to GoPlus Security, the malicious frontend induced users to sign token approvals, including EIP-2612 permits and Permit2 authorizations, initially leading to an estimated $350,000 in losses across Ethereum, Arbitrum, Base, BNB Chain, Ink, and Plasma. A subsequent trace by Bitquery estimated total losses of approximately $401,900 across nine wallets. Bitquery found that about $305,000 came from a single user's Aave deposit tokens, which were siphoned across four transfers before the owner revoked permissions one minute after the final transaction.[3][4][5]
Key facts
- Across Protocol suffered a domain hijack around 18:45 UTC on Nov. 10, 2026, after registrar Namecheap succumbed to a social engineering attack.
- SEAL911 flagged across.to as a phishing site with major wallets, and Cloudflare stripped the domain's DNS records to contain the attack.
- Across restored its systems by 01:16 UTC on Nov. 11, 2026, and confirmed that third-party integrations and API users were not affected.
- The protocol pledged to fully compensate all affected users and publish a post-mortem on the takeover.
- GoPlus Security reported that the phishing page used EIP-2612 permits and Permit2 authorizations to drain funds across six blockchains.
- Bitquery estimated total losses reached approximately $401,900 across nine wallets, including $305,000 in Aave deposit tokens taken from a single victim.
Sources · 5 sources
- DE
Decrypt@DecryptMediaPost on X ·
Crypto Bridge Across Says It Has Regained Its Domain After a Registrar Takeover. Across said a social engineering attack on its registrar Namecheap gave a bad actor control of its domain at about 1:45 PM EST Tuesday, adding that all affected users will be made whole. https://t.co/TbiT3s9xQL
Open source - CP
Crypto Patel@CryptoPatelPost on X ·
Across Protocol Recovers Domain After Hijack Attack @AcrossProtocol has regained control of "https://t.co/Pp94y9mq01" following a social engineering attack targeting its domain registrar, Namecheap. The attacker briefly took control of the official domain, exposing users to a malicious frontend. Across quickly suspended services and worked with SEAL911 and Cloudflare to contain the threat. All systems are now operational, and the team has pledged to fully reimburse affected users. Smart contract security alone isn't enough. Your domain, DNS, frontend and infrastructure are equally critical parts of DeFi security. Reported losses of approximately $294K remain unconfirmed.
Open source - CR
CryptoSlate@CryptoSlatePost on X ·
A spending permission requested through a fake Across site let attackers take about $305,000 in tokens representing an Aave deposit, @Bitquery_io’s reconstruction finds. The owner revoked it one minute after the last of four transfers. via @akibablade https://t.co/c1PzuUkzA1
Open source - UN
UnchainedArticle ·
Across Back Online After Namecheap Social Engineering Handed Domain to Attacker Across , a cross-chain bridge that moves tokens between blockchains, said on X at 01:16 UTC on Wednesday that it was “fully restored, and all systems are operational,” after an attacker took control of its across.to domain on Tuesday and pointed visitors to a phishing page. The post came about six and a half hours after the start of the attack, which the protocol put at roughly 18:45 UTC on Nov. 10. Blockchain security firm GoPlus Security estimated user losses at $350,000 , spread over Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma. Across has not confirmed that number in its posts. Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter . How the Takeover Happened Across said late Tuesday in a post on X that “a social engineering attack on @Namecheap (our domain registrar) gave a bad actor control of the Across domain,” and that “despite our best efforts, @Namecheap has been unresponsive.” Its domain “was fully locked down with best-in-class security practices; this unauthorized takeover should not have been possible,” Across said, promising a post-mortem. The team said it learned of the attack within 15 minutes and moved to take the site offline, while SEAL911 (a crypto security emergency hotline) flagged the address to major wallets as a phishing site and Cloudflare helped Across label the domain as risky, then stripped the domain’s Domain Name System (DNS) records, the entries that point a web address to a server. Losses and Next Steps According to GoPlus, the fake page got users to sign token approvals, which the attacker then used to pull funds. They included EIP-2612 permits, an Ethereum Improvement Proposal (EIP) standard that grants spending rights through an offchain signature, and authorizations for Permit2, a widely used token-approval contract that lets a single signature authorize transfers from a wallet. Visitors who reached across.to before Cloudflare shut the site off completely “may have been affected,” Across said, adding that third-party integrations and developers using its application programming interface (API) were not. It asked anyone hit to message it with transaction details and to revoke any permissions granted to the attacker. In its restore post, Across thanked Namecheap’s founder Richard Kirkendall “for responding on X, helping us secure our account” and opening an investigation, and said: “All affected users will be made whole.” It said a full post-mortem would follow “in the coming days.” Across hasn’t explained how the attacker talked their way into its Namecheap account; it said the post-mortem would cover how the takeover was possible. Related Listen: Why a Nation State Will Always Beat the Security of a DeFi Team The post Across Back Online After Namecheap Social Engineering Handed Domain to Attacker appeared first on Unchained .
Open source - CR
CryptoSlateArticle ·
Aave user loses $305,000 after Across Protocol website hijack Bitquery's November 12 update estimates $401,900 across nine wallets, including about $305,000 from one Aave deposit token. Read the full story on CryptoSlate Understand the crypto stories that matter and what to watch next. Get The Catalyst in your inbox
Open source