Across Protocol restores site after domain hijack, vows refunds

Across Protocol regained control of its website on November 11, a day after attackers hijacked the across.to domain and pointed visitors to a phishing page that drained crypto wallets. The protocol says it will repay everyone who lost funds.

In statements posted on X, Across traced the takeover to a social engineering attack on its domain registrar, Namecheap. The Block, Cointelegraph and crypto.news each carried the report. Security firm GoPlus put early losses near $350,000, a figure Across has not confirmed.

What happened

Across is a cross-chain bridge. It moves tokens between Ethereum and the faster, cheaper networks built on top of it. None of that machinery failed here. The attack sat one layer above it, on the ordinary web plumbing that any website relies on: a domain name and the company that registers it.

At around 18:45 UTC on November 10, someone took control of the across.to domain. Visitors who typed the usual address landed on a copy of the real app. The clone asked them to sign token approvals and permits. Those signatures handed the attacker permission to move funds.

Across said it got an alert within 15 minutes and began trying to pull the site offline. That took time. The weak point sat outside its own systems, at the registrar that controls where the domain points. The smart contracts were never touched. No contract was broken.

Why a domain hijack is not a smart contract hack

A domain hijack does not break the code that holds the money. It poisons the signpost that points people to that code. Across's contracts kept running the whole time. The vault stayed shut. The real danger was the fake front door.

Picture a bank branch where the vault is untouched but the street sign has been swapped for a crook's. Customers walk in, hand over their details, and never notice the switch. On-chain, the trap is a signature. The fake page prompted people to approve tokens, sign EIP-2612 permits or Permit2 authorizations, or send funds straight to addresses the attacker controlled, according to GoPlus. Any one of those can empty a wallet. It is tempting to file this under smart contract risk. The evidence points elsewhere. An audit would not have caught it, because an audit checks the contract code, not who owns the web address. That gap, and what a review can and cannot promise, is covered in our guide to smart contract audits.

The response, and a slow registrar

Help came from several directions. SEAL911, a volunteer security response group, flagged across.to as a phishing domain with major wallet providers. Cloudflare marked the address as dangerous and later stripped its DNS records, which cut the fake site off. Across suspended its own frontend and API while it worked to get the domain back.

Namecheap did not answer the first requests, Across said. The breakthrough came from the top. Across later thanked Namecheap founder Richard Kirkendall for helping secure the account and opening an investigation. By Wednesday the across.to domain was back under the protocol's control and running normally.

While the domain was out of its hands, Across told people to stay away from the app and warned that wallets were being drained. The frontend and API stayed down until the registrar account was secured. That left the service offline for legitimate users for the better part of a day, the price of cutting the attacker off at the source.

What Across has, and has not, confirmed

Across has been plain about the gaps. It has not said how many users were hit. It has not confirmed a loss total. The only public number is the GoPlus estimate of about $350,000, spread across six networks: Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma.

The protocol did promise money back. In a Wednesday update, the team wrote on X, "All affected users will be made whole. We'll share a full post-mortem in the coming days." It also said people who used the app before the attack, along with API and third-party integration users, were not affected. For scale, Across ranked third among cross-chain messaging protocols by 30-day transfer volume on November 11, behind Circle and LayerZero, with about $5.9 billion moved, according to DefiLlama data cited by Cointelegraph.

A pledge to repay phishing victims is not routine. In many wallet-drainer cases the user signed the transaction, so the loss falls on them and the project owes nothing. Across is taking a different line, treating the hijack of its own domain as its own responsibility. How far that promise stretches, and who qualifies, should be clearer once the post-mortem is out.

What to watch

What to watch is the post-mortem. It should explain how the attacker talked Namecheap into moving the domain, how many wallets were drained, and how the refunds will work. Until it lands, the $350,000 stays an outside estimate, not a confirmed count.

The incident carries a wider lesson for crypto holders. The address bar is not proof of safety. A bookmarked link can still resolve to a hijacked server when the domain itself is stolen. The safer habit is to read each transaction before approving it, rather than trusting the logo on the page. Anyone who visited across.to on November 10 should review and revoke the wallet approvals granted that day, which tools such as Revoke.cash make possible. The same caution applies before buying an unfamiliar token, a process walked through in our guide on how to check a token before buying.