---
title: "Across Protocol Restores Website After Domain Hijack Leads to Phishing Drains"
description: "The cross-chain bridge regained control of its domain following a Namecheap social engineering compromise and pledged to compensate affected users."
url: https://basisdesk.news/news/across-protocol-recovers-domain-phishing-hijack
published: 2026-11-11T05:01:59.117Z
modified: 2026-11-11T05:01:59.117Z
section: Security & Hacks
author: Basis Desk Newsroom (AI-generated, source-verified)
sentiment: bearish
tickers: []
tags: [across-protocol, phishing, dns-hijack, bridges, namecheap]
license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice.
---

# Across Protocol Restores Website After Domain Hijack Leads to Phishing Drains

The cross-chain bridge regained control of its domain following a Namecheap social engineering compromise and pledged to compensate affected users.

## At a glance

- **What happened:** Across Protocol recovered its domain after a social engineering attack on Namecheap allowed attackers to replace its frontend with a phishing site.
- **Why it matters:** Frontend hijacking compromised user wallets despite underlying bridge contracts remaining secure, prompting the team to promise full reimbursement.
- **Who is affected:** Users who connected their wallets to the across.to domain during the breach window on Tuesday.
- **What's next:** The Across Protocol team plans to publish a comprehensive post-mortem detailing the attack and remediation in the coming days.
- **Primary source:** [Across Protocol restores website after hackers hijack domain](https://cointelegraph.com/news/across-protocol-restores-website-after-hackers-hijack-domain?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound) — cointelegraph.com

## Key points

- Attackers hijacked Across Protocol's across.to domain around 18:45 UTC on Tuesday using a social engineering attack against registrar Namecheap [1].
- SEAL911 and Cloudflare intervened to restrict traffic before the team recovered the domain with help from Namecheap's founder [1].
- Across pledged to make all affected users whole and noted third-party integrations and API users were unaffected [1].

## Editorial remark

- **Context:** Registrar-level social engineering remains a critical vulnerability for DeFi platforms relying on Web2 infrastructure for frontend routing, bypassing smart contract security entirely.
- **Impact:** Users who executed transactions on the compromised frontend face wallet losses, while Across faces compensation costs; API consumers and integrators avoided harm.
- **Watch:** Release of the official Across post-mortem report and details on the compensation claims process.

Cross-chain bridge Across Protocol regained control of its website after a social engineering breach at its domain registrar compromised the platform's frontend, the protocol announced [1]. The breach occurred around 18:45 UTC on Tuesday, when attackers leveraged registrar Namecheap to hijack the across.to domain and replace it with a malicious phishing interface designed to drain interacting wallets [1]. The incident comes amid broader industry vigilance regarding [DeFi Frontend and DNS Hijacking Attacks, Explained](https://basisdesk.news/news/dns-hijacking-frontend-attacks).

Across stated it detected the unauthorized takeover within 15 minutes and mobilized security partners to limit exposure [1]. Security collective SEAL911 marked the address as phishing across prominent wallet providers, while Cloudflare flagged the site as high risk before wiping its DNS entries [1]. The protocol managed to recover the domain with assistance from Namecheap founder Richard Kirkendall, reporting that core systems have resumed normal operations [1]. Across noted that third-party integrations and API connections remained insulated from the breach, though users visiting the web app prior to DNS remediation were exposed to fraudulent contracts [1].

## Impact and Operational Scale

The total value drained and the exact tally of affected wallets remain undisclosed [1]. However, Across committed to compensating impacted individuals, confirming on X that all affected users will be made whole [1]. The breach targeted one of the ecosystem's largest liquidity routing protocols; Across ranked third in 30-day transfer volume behind Circle and LayerZero, logging approximately $5.9 billion in bridge volume over that window according to DefiLlama data [1]. Across indicated it will publish a full post-mortem detailing the incident in the coming days [1].

## Sources

1. [Across Protocol restores website after hackers hijack domain](https://cointelegraph.com/news/across-protocol-restores-website-after-hackers-hijack-domain?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound) — cointelegraph.com, 2026-11-11

---
Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai