Across restores site after phishing attack, with losses estimated at $350,000

Across attributed the takeover to social engineering targeting domain registrar Namecheap. The attacker changed the website’s domain settings rather than exploiting the bridge’s smart contracts. The protocol said it received an alert within 15 minutes and moved to disable the compromised site. Its frontend and API services were temporarily suspended during recovery.

Security response group SEAL911 helped flag across.to as a phishing site, and Cloudflare classified the domain as dangerous before removing its DNS records. Across later thanked Namecheap founder Richard Kirkendall for helping secure the account and opening an investigation. The protocol said its own security controls and the circumstances of the takeover would be examined in a forthcoming post-mortem.

GoPlus said the phishing page may have prompted users to sign EIP-2612 permits, Permit2 authorizations or direct token approvals, which can let an approved spender transfer tokens. Some users may also have sent cryptocurrency directly to attacker-controlled addresses. The estimate covers activity on Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma. Across has not independently confirmed the loss figure or disclosed how many users were affected.

The team said people who visited its site before the attack, as well as API users and third-party integrations, were unaffected. Users who connected wallets during the incident were advised to review and revoke approvals granted on November 10 through Revoke.cash. Revoking a permission cannot recover funds already transferred, and malicious permits may require additional precautions. Across asked affected users to contact its official account with wallet addresses and transaction hashes, and warned against unsolicited messages from people claiming to represent the protocol. It said a detailed report on the takeover is still to come.