Across Protocol says an attacker hijacked its website domain through its registrar, Namecheap

Across Protocol, which describes itself as cross-chain infrastructure for moving crypto between blockchains, said an attacker took control of its across.to website domain on November 10 through a social engineering attack on its domain registrar, Namecheap, and used it to show users a phishing site. Across said in a post on X early on November 11 that the domain was back under its control and that "All affected users will be made whole."

How the Across Protocol domain hijack unfolded

At 19:05 UTC on November 10, Across warned users to stay away from its app and not to connect wallets or approve anything there until further notice. In a longer update at 22:13 UTC, it said the attack on Namecheap had given "a bad actor control of the Across domain" at about 18:45 UTC, that its team was alerted within 15 minutes, and that no third-party integrations or users of its API were affected.

According to Across, the security group SEAL911 got major wallets to flag the domain as phishing, and Cloudflare marked it as risky and later removed its DNS records, the settings that point a domain to a server. Across said some visitors may have been affected in the short window before the phishing site was fully blocked, and asked anyone affected to contact it with transaction details and to revoke permissions they had granted to the attacker. It has not said how much was lost or how many users were affected.

In that update, Across also said Namecheap had been unresponsive and that the takeover "should not have been possible" given how the domain had been secured. We found no formal statement from Namecheap about the incident when we checked on November 11; Across later said the company's founder had responded on X.

How it was restored

At 01:16 UTC on November 11, Across said all its systems were working normally again. It credited Namecheap's founder with replying on X, helping it lock down its account and starting an investigation, and said any lingering wallet or browser warnings about the site should soon disappear.

The team said a full post-mortem would follow in the coming days, that it would communicate only through its official channels, and warned users not to trust messages or links from other sources claiming to be from Across.

Why it matters

Across described the attack as a takeover of the website domain that users visit; none of its three posts named the bridge's smart contracts as affected. Domain hijacks are a known way to target crypto users: at the end of October, attackers hijacked several DeFi websites registered with Name.com. Such attacks work by sending visitors to a fake copy of a familiar site, where they are asked to approve transactions that hand control of their tokens to the attacker.

What it could mean for users

Across's advice for anyone who believes they were affected is to revoke any permissions granted to the attacker and to send the team their transaction details. In our assessment, the episode is another reminder that a familiar web address is not proof of a safe site. This week also brought a warning from Binance about an iOS flaw that it says could expose wallet keys.