TL;DR: Crosschain bridge protocol Across had its official domain hijacked for roughly 15 hours on November 10 and 11 after attackers social-engineered their way into its account at domain registrar Namecheap. The hijacked domain redirected visitors to a phishing clone that tricked people into signing malicious token approvals, and security firm GoPlus estimates the damage at around $350,000 across six different blockchains. Across says it has fully restored its systems and will make every affected user whole, but the incident is another reminder that a crypto protocol’s smart contracts can be airtight while its website is still one phone call away from disaster.
A domain, not a contract, was the weak link
Across Protocol isn’t a household name outside DeFi circles, but it’s one of the more widely used bridges for moving assets between Ethereum, Arbitrum, Base, BNB Chain, and a handful of other chains. Its pitch has always been speed and low fees, backed by a network of relayers and an optimistic verification system that’s been audited repeatedly. None of that mattered on November 10, because the attackers didn’t bother trying to break the protocol itself.
Instead, around 18:45 UTC, someone talked their way past Namecheap’s account security and took control of across.to. Across said in a post on X that its team got an alert within about 15 minutes, which is fast by the standards of these incidents, and immediately started pulling the site offline. It wasn’t fast enough to stop the damage entirely. Whoever had the domain pointed it at a convincing phishing clone of the real site, and for a window of time, anyone who visited across.to and connected their wallet was looking at a fake.
How the phishing page actually drained wallets
The clone didn’t ask people to type in a seed phrase, which is the crude version of this scam. It did something more effective: it prompted visitors to sign what looked like a routine transaction, token approval, or permit message. Anyone who approved it handed the attacker a standing authorization to move tokens out of their wallet, no further confirmation needed. That’s a much quieter theft than a direct drain, and it’s why these domain-hijack phishing pages are so dangerous even when the underlying smart contracts are completely untouched.
GoPlus Security, which tracks on-chain phishing activity in real time, put total user losses at roughly $350,000, spread across wallets on Ethereum, Arbitrum, Base, BNB Chain, Ink, and Plasma. That’s a small number next to this year’s headline breaches, but it’s not nothing, and it landed on individual users rather than the protocol’s treasury. Across has not published its own tally of affected wallets or confirmed GoPlus’s figure directly, though it hasn’t disputed it either.
The response moved faster than the attack
Credit where it’s due: the containment here was genuinely quick. Within minutes of Across flagging the hijack, the security response group SEAL911, which coordinates incident response across multiple wallet providers and protocols, started warning major wallets about the malicious domain. Cloudflare, which was handling DNS for the hijacked domain by that point, marked it as high-risk and pulled its DNS records, which effectively killed the phishing site’s ability to resolve for most visitors even while the domain was still technically out of Across’s hands.
Across says it worked with Namecheap to recover control of the domain and, as of Wednesday, November 11, has restored every system to normal operation. The team also committed to making affected users whole, though it hasn’t released a timeline or mechanism for compensation yet. That promise is worth watching. “We’ll make it right” is the standard line after an incident like this, and whether it actually happens, and how quickly, tends to separate the protocols people trust from the ones they quietly stop using.
Registrars are the soft underbelly of crypto security
This is the part that should bother anyone running a crypto product, not just Across. A domain registrar account is usually protected by, at best, two-factor authentication and a support line staffed by people who have no idea what’s riding on the account they’re helping someone “recover.” Social engineering a registrar doesn’t require finding a bug in anyone’s code. It requires finding one tired or rushed support agent willing to reset account access for someone who sounds convincing enough.We’ve covered this exact failure mode before. When attackers compromised a Web3Auth and Keplr wallet infrastructure last week, the entry point was similarly off-chain, not a flaw in the cryptography everyone had spent months auditing. And the pattern isn’t limited to wallets and domains. The breach at NEAR AI’s inference infrastructure earlier this month traced back to a deprecated internal system that should have been shut off entirely, not a weakness anyone found in NEAR’s actual AI models. The theme across all of these: the parts of a crypto product that get the least security budget, the registrar account, the old internal tool, the support desk, are exactly where attackers are choosing to spend their time, because the parts everyone audits obsessively have gotten harder to crack.
Across isn’t alone in having a rough week on the DeFi security front, either. The same day, decentralized exchange Arcus disclosed it lost about $2.23 million in USDG stablecoins to an accounting bug, separate from the Across incident entirely. The exploiter tried to pull an additional $3 million before the bridge’s own rate limiting blocked the withdrawal. Two unrelated incidents, same 24-hour window, same underlying lesson: the attack surface in DeFi keeps shifting away from the contracts themselves and toward everything sitting around them.
What users should actually do about this
If you interacted with across.to between roughly 18:45 UTC on November 10 and the restoration announcement on November 11, it’s worth checking your wallet’s token approvals on a site like Revoke.cash or Etherscan’s token approval checker, and revoking anything you don’t recognize or don’t remember authorizing. A signed approval doesn’t expire just because the phishing site went offline. If you didn’t visit the site during that window, there’s nothing to do here beyond the general habit of bookmarking the real URLs of protocols you use regularly instead of trusting a search result or a link from social media.
The bottom line
Across built a bridge that, as far as anyone can tell, worked exactly as designed throughout this entire episode. The money that got stolen didn’t come out of a smart contract exploit; it came out of a registrar’s support queue. That’s almost worse, in a way, because it means the usual DeFi security playbook, audits, bug bounties, formal verification, doesn’t touch the actual point of failure. Until registrars treat high-value crypto domains with something closer to the paranoia banks apply to wire transfers, this exact story is going to keep repeating with a different protocol’s name attached.
The Teck Hustlers Editorial Team covers technology, business, finance and gaming news for readers who want the story behind the headline. Every article is researched, written and edited by our in-house team, checked against company announcements, filings and reputable reporting, and updated when new facts emerge. We focus on what each development means for founders, professionals, investors and everyday users. Have a tip or a correction? Reach us through our contact page.
