Across Protocol Restores Website After Domain Hijack Leads to Phishing Drains
The cross-chain bridge regained control of its domain following a Namecheap social engineering compromise and pledged to compensate affected users.
At a glance
- What happened
- Across Protocol recovered its domain after a social engineering attack on Namecheap allowed attackers to replace its frontend with a phishing site.
- Why it matters
- Frontend hijacking compromised user wallets despite underlying bridge contracts remaining secure, prompting the team to promise full reimbursement.
- Who is affected
- Users who connected their wallets to the across.to domain during the breach window on Tuesday.
- What's next
- The Across Protocol team plans to publish a comprehensive post-mortem detailing the attack and remediation in the coming days.
- Primary source
- cointelegraph.com: Across Protocol restores website after hackers hijack domain
Key points
- Attackers hijacked Across Protocol's across.to domain around 18:45 UTC on Tuesday using a social engineering attack against registrar Namecheap 1.
- SEAL911 and Cloudflare intervened to restrict traffic before the team recovered the domain with help from Namecheap's founder 1.
- Across pledged to make all affected users whole and noted third-party integrations and API users were unaffected 1.
Cross-chain bridge Across Protocol regained control of its website after a social engineering breach at its domain registrar compromised the platform's frontend, the protocol announced 1. The breach occurred around 18:45 UTC on Tuesday, when attackers leveraged registrar Namecheap to hijack the across.to domain and replace it with a malicious phishing interface designed to drain interacting wallets 1. The incident comes amid broader industry vigilance regarding DeFi Frontend and DNS Hijacking Attacks, Explained.
Across stated it detected the unauthorized takeover within 15 minutes and mobilized security partners to limit exposure 1. Security collective SEAL911 marked the address as phishing across prominent wallet providers, while Cloudflare flagged the site as high risk before wiping its DNS entries 1. The protocol managed to recover the domain with assistance from Namecheap founder Richard Kirkendall, reporting that core systems have resumed normal operations 1. Across noted that third-party integrations and API connections remained insulated from the breach, though users visiting the web app prior to DNS remediation were exposed to fraudulent contracts 1.
Impact and Operational Scale
The total value drained and the exact tally of affected wallets remain undisclosed 1. However, Across committed to compensating impacted individuals, confirming on X that all affected users will be made whole 1. The breach targeted one of the ecosystem's largest liquidity routing protocols; Across ranked third in 30-day transfer volume behind Circle and LayerZero, logging approximately $5.9 billion in bridge volume over that window according to DefiLlama data 1. Across indicated it will publish a full post-mortem detailing the incident in the coming days 1.
Sources
- [1] Across Protocol restores website after hackers hijack domain — cointelegraph.com, November 11, 2026
Written by Basis Desk's newsroom system from the primary sources above and machine-verified against them before publication. Market figures marked "at the time of writing" come from live exchange data. Report an error: corrections@basisdesk.news · corrections policy.
The Daily Brief, in your inbox at 07:00 ET
Five stories, the numbers that moved, what to watch. Three minutes. No hype, no advice, unsubscribe in one click.
Get the big crypto stories first
A few alerts a day at most: major breaking news and the morning brief. Switch off anytime.
Not financial advice. Basis Desk publishes information, not recommendations. Crypto assets are volatile and you can lose what you invest.