Across Protocol has regained control of its official domain after attackers used social engineering against registrar Namecheap to redirect across.to to a phishing site designed to drain wallets.
The incident began at approximately 18:45 UTC on Nov. 10. Across said it was alerted within 15 minutes and immediately began limiting exposure, while security response group SEAL911 flagged the domain with major wallet providers and Cloudflare removed its DNS records. Control was restored on Nov. 11 with help from Namecheap founder Richard Kirkendall, and the protocol reported all systems operational.
Security platform GoPlus estimated losses at roughly $350,000 across six networks: Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma. Users who interacted with the fake interface were encouraged to sign fraudulent token approvals and permit authorizations, allowing attackers to transfer assets without further approval. Across said third-party integrations and API users were unaffected but has not disclosed the number of affected users.
The protocol pledged to make affected users whole and to publish a full post-mortem. Across remains one of the most active interoperability protocols, with roughly $5.9 billion in 30-day transfer volume. The attack highlights that frontend and domain security remain critical even when underlying smart contracts are not compromised.
