Cross-chain bridge Across Protocol says it has regained control of its website domain after attackers hijacked it through a social engineering attack on its domain registrar, Namecheap, and redirected users to a phishing page.

The attack began on Tuesday 10 November at about 18:45 UTC. Across said the attacker gained control of its across.to domain and replaced the site with a phishing page. The team posted an update on Wednesday 11 November saying all systems had resumed normal operations.

Wallets drained after phishing redirect

On Tuesday, Across warned users not to use its app, connect their wallets or sign any transactions or approvals while it investigated a possible security incident. At that stage the team did not say what had happened or whether the website had been compromised.

Users soon began reporting losses on X. One user said they lost $9,000 in the stablecoin USDC. Another reported losing 7,053 USDT0 across seven transactions on the Plasma blockchain. A third said their wallet was drained after they used the bridge several times. Those individual loss claims have not been independently verified, and Across has not said how much money was lost in total or how many users were affected.

Across said it was alerted within 15 minutes of the attack starting and worked to shut the website down immediately. Security response group SEAL911 helped flag the domain as phishing with major wallets, and Cloudflare marked the domain as at risk before removing its DNS records.

Across said it recovered the domain with help from Namecheap founder Richard Kirkendall. It added that some users who visited the domain before the phishing site was fully blocked may have been affected, while third-party integrations and API users were not affected.

Compensation and post-mortem promised

"All affected users will be made whole," the Across team said, adding that it will publish a full post-mortem in the coming days. The team asked users who believe they were affected to share transaction details so each report can be investigated.

Across is a cross-chain bridge that lets users move digital assets between Ethereum and other blockchain networks. According to DefiLlama, it ranked third among cross-chain bridges by 30-day transfer volume, behind Circle and LayerZero, processing about $5.9 billion over that period.

The incident follows a separate wave of domain hijacks in late October, when attackers took over a dozen crypto websites registered with Name.com and redirected visitors to wallet-draining pages. In the Across case, the registrar involved was Namecheap, and Across says the takeover was achieved through social engineering rather than a technical breach of its own systems.

Frequently asked questions

How did attackers take over the Across domain?
Across said a social engineering attack on its domain registrar, Namecheap, gave an attacker control of the across.to domain, which was then pointed at a phishing site.

Will affected users be compensated?
Across said all affected users will be made whole and that a full post-mortem will be published in the coming days. It has not yet said how much was lost.

Is the Across app safe to use now?
Across said it has regained control of the domain and that all systems are working normally, but users should still check they are on the genuine site before connecting a wallet.

Sources: CoinCentral and KuCoin.