Cross-chain bridge Across lost control of its official domain on November 10, 2026, and regained it less than seven hours later after a social engineering attack on registrar Namecheap. The smart contracts were not compromised, but a cloned phishing page drained user wallets, adding to a sharp rise in hack-related losses this year.
🔑 In brief
- The across.to domain was replaced by a phishing page for roughly six and a half hours.
- The attack vector was a compromise at registrar Namecheap, not a flaw in the bridge contracts.
- GoPlus estimates total losses at about $350,000; Across has not published an official figure.
- Revoking outstanding token approvals remains the priority step for affected users.
A sub-seven-hour takeover of the official domain
On November 10, 2026, at around 18:45 UTC, an attacker took control of across.to, the official domain of the Across protocol. The legitimate site was replaced by a phishing page designed to empty the wallets of visitors. According to Across, the intrusion stemmed from a social engineering attack on registrar Namecheap, meaning manipulation of staff to gain access or alter an account. The exact method was not detailed at the time, and Namecheap had not publicly commented.
Across says it received an alert less than 15 minutes after the takeover began and immediately tried to take the site offline. SEAL911, the Security Alliance’s emergency response team, flagged the domain as a phishing site to major wallet providers. Cloudflare first marked the domain as risky, then removed its DNS records, making the malicious page unreachable.
| Time (UTC) | Event |
|---|---|
| Nov. 10, 18:45 | across.to taken over and replaced by a phishing page |
| Under 15 min later | Alert received by Across, attempt to take the site offline |
| Nov. 10, 19:05 | Warning posted on X: do not connect wallets or sign anything |
| Nov. 10, 22:13 | Statement: Namecheap still unresponsive, domain not secured |
| Nov. 11, 01:16 | Domain recovered with Namecheap’s help, services restored |
“Despite all our efforts, Namecheap remained unresponsive.”
Across team, statement posted on X, November 10, 2026
The timing matters. By 19:05 UTC, several users were already reporting drained wallets, which shows how quickly the risk window closes, long before any technical remediation. Across said the registrar’s silence prevented it from fully securing the domain and restoring the web interface and API, both of which were offline.
Contracts intact, but the risk surface was real
Across stresses a central point: the incident hit the web infrastructure leading to the protocol, not its blockchain contracts. The team states that its smart contracts were not compromised, nor were funds deposited in the bridge contracts or the liquidity supplied by participants. Transfers initiated on the authentic site before the attack remained secure.
Where the exposure sat
- The API and third-party apps that integrate Across in the background were not compromised, although the API was kept offline during remediation.
- The dangerous combination was visiting across.to during the hijack window, connecting a wallet, then confirming a signature or transaction.
- Internal transfers offered by a centralized exchange, which do not require the user’s wallet authorization, were not exposed to this vector.
Wallet software shows what is being signed, but it cannot verify whether the page requesting the signature is authentic. That gap is exactly what makes signature-based phishing effective, even when the underlying blockchain functions normally.
Estimated losses, invisible approvals and revocation
Across has not published an official loss figure or the number of affected users. Security platform GoPlus puts total losses at roughly $350,000, with stolen funds spread across Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma. A separate figure of about $294,000 circulated in some media without a traceable source and was not treated as reliable.
Individual victims reported losses of 9,000 USDC and 7,053 USDT0, drained through seven transactions on Plasma. These amounts come from the victims themselves and have not been independently verified. GoPlus has not provided a full breakdown by asset, wallet or chain.
According to GoPlus, the fake page relied on three authorization methods, each with very different visibility:
| Method | Visibility | Effect |
|---|---|---|
| Direct token approval | Visible in the blockchain explorer | Lets a third-party address transfer a specific token |
| EIP-2612 signature | Off-chain, free, invisible until submitted | Produces the same effect as a direct approval |
| Permit2 | Contract widely used by applications | Lets an authorized address grant another address access through a new signature |
Some victims were also tricked into sending cryptocurrency directly to attacker addresses. No technical permission was involved in those cases; the transfers were simply voluntary.
Revocation checklist
- Contact the Across team through its official direct messages on X, providing transaction details.
- Revoke permissions granted on November 10 or 11 using Revoke.cash.
- Review approvals with the Etherscan approval checker or the Arbitrum and BNB Chain explorers.
- Look for unknown recipients, unlimited amounts and approvals dated on those two days; GoPlus flagged several destination addresses as suspicious.
- If funds remain, move them to a new address, because an unsubmitted EIP-2612 signature can stay invisible in approval lists.
Each revocation is a new transaction that pays network fees. It does not recover drained funds, but it stops the attacker from accessing the wallet again. Keeping wallet addresses, transaction hashes, timestamps and screenshots will support any future reimbursement claim.
A sharp rise in hack-related losses
Across is not a marginal player. According to DefiLlama, it processed about $5.9 billion in assets over the 30 days before the incident, ranking third behind Circle and LayerZero among the largest cross-chain bridges by volume. On the same day, a separate group hijacked several domains through registrar Name.com and deployed a drainer on twelve DeFi sites.
These events fit a broader upward trend. DefiLlama counts $8.78 billion lost across 341 hacks and exploits since the start of 2026, while Blockaid estimates losses above $1.1 billion in the first half of the year. The Block notes that artificial intelligence tools are speeding up attacks and making them more sophisticated.
For perspective, the 2022 Ronin bridge attack removed more than $600 million from the contracts themselves. That was a different vector and a far larger scale. In March, the Neutrl protocol had also paused its contracts after suspected hijacking of its DNS interface.
“All affected users will be fully reimbursed. We will publish a full post-mortem in the coming days.”
Across team, statement posted on X, November 11, 2026
At the time of recovery, no claim form, deadline or payout channel had been published. Across warned against fake refund pages, impersonation through direct messages, and forms asking for a recovery phrase. No legitimate procedure requires that phrase, which would give a third party complete control of the wallet.
On the market side, the only data point came from The Block, which showed the ACX token down 0.76%. Sources do not link that move to the incident, and ACX was not the drainer’s target.
Conclusion: outlook and scenarios
The episode exposes a structural weakness: the security of a decentralized protocol also depends on web, DNS and registrar layers run by centralized providers. The contracts held, but users lost funds to deceptive signature requests.
Three scenarios remain open. In the base case, Across publishes a detailed post-mortem, reimburses identified victims and hardens the domain’s authentication, which could rebuild trust within weeks. In a less favorable case, the report is delayed or partial, and the true scale of losses stays unclear. In a breakdown scenario, another intrusion or lasting blocklists would weaken the bridge’s usability. Users should watch for the report and review active approvals in their wallets.
Sources
- The Block, Across restores systems after domain hijack
- Cointelegraph via TradingView, Across restores website
- CryptoTicker, Across bridge domain hijack
- Bloomingbit, Across news feed
- Crypto Times, Across domain hijacked via Namecheap
- Ground News, DNS registrar attack against Across
Cet article est publié à titre informatif et éducatif. Il ne constitue en aucun cas un conseil en investissement. Faites vos propres recherches (DYOR) avant toute décision.
