Across Protocol restores website after phishing attack, $350K in estimated losses
Across Protocol has restored its website following a November 10 domain hijacking attack that redirected users to a fraudulent page, with security researchers estimating that approximately $350,000 was stolen from cryptocurrency wallets.
Summary
- Across Protocol restored its website after attackers hijacked its domain through a reported Namecheap social engineering attack.
- GoPlus estimated nearly $350,000 in losses across six blockchain networks following the phishing incident.
- Attackers reportedly used malicious token approvals and permit signatures to access users’ cryptocurrency wallets.
- Across confirmed that API users and third-party integrations were unaffected by the website compromise.
- The protocol promised to compensate affected users and release a detailed report on the attack.
In a Wednesday update, the cross-chain bridge confirmed that its domain was back under its control and all systems were operating normally. The team attributed the attack to social engineering involving domain registrar Namecheap and promised to compensate affected users.
“All affected users will be made whole. We’ll share a full post-mortem in the coming days,” Across stated.
Security firm GoPlus estimated that the phishing operation affected wallets across Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma. Across has not disclosed its own confirmed loss figure or the total number of affected users.
Across Protocol says attackers gained control through Namecheap
The incident began at approximately 18:45 UTC on November 10, when an attacker gained unauthorized control of the Across domain following what the protocol described as a social engineering attack targeting Namecheap.
Rather than exploiting the bridge’s smart contracts, the attacker manipulated the website’s domain settings and directed visitors to a phishing page designed to resemble the legitimate service.
In its incident disclosure, Across said it received an alert within 15 minutes and immediately began working to shut down the compromised website.
Security response group SEAL911 helped flag across.to as a phishing site with major cryptocurrency wallets. Cloudflare subsequently classified the domain as dangerous before removing its DNS records, preventing visitors from reaching the fraudulent page.
The measures were taken while the protocol worked to regain control of its domain registrar account. Across temporarily suspended its frontend and API services during the recovery process.
At that stage, the team said Namecheap had not responded to its requests for assistance. However, its subsequent announcement thanked Namecheap founder Richard Kirkendall for helping secure the account and opening an investigation.
Across maintained that its domain had been protected by established security controls and said the circumstances surrounding the unauthorized takeover would be examined in its post-incident report.
Phishing attack reportedly drains $350K from user wallets
The estimated losses stemmed from transactions and permissions obtained through the fraudulent website during the period when attackers controlled the domain.
According to GoPlus, users who interacted with the phishing page could have been persuaded to sign EIP-2612 permits, Permit2 authorizations or direct token approvals.
Such permissions can allow an approved spender to transfer tokens from a wallet without requiring the owner to authorize every subsequent transaction.
In some cases, victims may have been persuaded to send cryptocurrency directly to addresses controlled by the attacker.
GoPlus identified several suspicious spender addresses associated with the incident and advised users to examine permissions granted during the attack.
The reported $350,000 loss estimate covers multiple blockchain networks, although Across has not independently confirmed the figure.
The team said users who accessed its website before the attack were not affected. Its statement further clarified that third-party integrations and API users were unaffected by the domain compromise.
The attack follows a separate series of DeFi website hijackings reported on October 31, when security firm Blockaid identified at least 12 websites serving the Step Drainer phishing toolkit.
Those incidents included Flap, which confirmed that a DNS attack had redirected visitors from its legitimate website to an unauthorized destination.
Across promises compensation as users check wallet approvals
Following the restoration, Across confirmed that its services were operational and advised potentially affected users to inspect their wallets for suspicious permissions.
In its security guidance, the team directed users who connected wallets during the attack to Revoke.cash to review and revoke authorizations granted on November 10.
Revoking an approval prevents further transfers using that permission, although it cannot reverse transactions that have already occurred.
Users who signed malicious permits may need to take additional precautions because some off-chain signatures can remain usable even when they do not appear among ordinary token approvals.
Across advised affected users to contact its official account with transaction details, including wallet addresses and transaction hashes, while warning against unsolicited messages impersonating its representatives.
The protocol said temporary browser and wallet phishing warnings could remain visible after the website’s restoration.
A separate Cloudflare-related phishing incident in October involved compromised API credentials that allowed attackers to send fraudulent messages appearing to originate from hardware wallet manufacturer Foundation.
Foundation said the incident affected its communication infrastructure but did not compromise customers’ hardware wallets or stored funds.
Across previously suffered a separate cross-chain security incident
The November phishing attack is separate from a July incident involving Across Protocol’s Risk Labs-operated relayer on Solana.
As crypto.news previously reported, attackers fabricated 1,627 Solana deposit events with a combined stated value of $41.7 million.
The relayer processed 581 fraudulent requests before suspending operations, resulting in a net loss of less than $4 million after accounting for trapped attacker funds.
Unlike that incident, the November attack targeted the protocol’s website domain and the wallet permissions of visitors who interacted with the fraudulent page.
Data from DefiLlama placed Across among the leading cross-chain bridges by transaction activity, with approximately $5.9 billion in transfers recorded over the preceding 30 days.
Across said its investigation into the November domain takeover remains ongoing and that it will release a detailed post-mortem explaining how the attacker gained control.