Image Credit: design.across.to
- Across restored its website after attackers hijacked its domain through a social engineering attack on its registrar.
- Bitquery estimated about $348,000 was taken from nine wallets, and Across pledged to make affected users whole.
- Users who signed malicious approvals or permits still need to revoke them, as restoring the site does not cancel them.
Across Protocol has restored its website after attackers took over its official domain and replaced it with a phishing page. The cross-chain bridge, which moves crypto between networks, has promised to compensate affected users.
Normal operations resumed on Nov. 11, according to Across. However, users who signed malicious wallet permissions during the takeover may still need to revoke them, even though the legitimate website is back.
Attackers Turned the Official Domain Into a Phishing Site
Across traced the takeover to a social engineering attack involving its domain registrar, Namecheap, at approximately 18:45 UTC on Nov. 10. Control of the domain lets the attacker send visitors to a fraudulent version of the service.
That creates a particularly awkward trap: users can enter the correct website address and still reach a page controlled by an attacker.
Across reported that it was alerted within 15 minutes and immediately began working to shut the site down. Security response group SEAL911 helped flag the domain as phishing with major wallets, while Cloudflare marked it as dangerous and subsequently removed its Domain Name System (DNS) records.
The bridge team later thanked Namecheap founder Richard Kirkendall for helping secure its account and opening an investigation. In its restoration update, Across announced:
“Across is fully restored, and all systems are operational.”
Across said third-party integrations and users accessing the protocol through its application programming interface (API) were unaffected by the takeover. It cautioned that some browsers and wallets could temporarily continue showing phishing warnings after the website’s restoration.
Restoring the Website Does Not Cancel Malicious Approvals
The remaining security concern sits inside wallets that interacted with the phishing page. Token approvals can authorize another address or contract to spend a user’s assets without requiring a fresh signature for each transfer.
Across directed potentially affected users to review and revoke permissions granted during the incident through Revoke.cash. Users who believe they were modified were also asked to contact its official X account.
Simply disconnecting a wallet from a website does not remove those permissions. Approvals remain active on the blockchain until they are revoked, so an attacker may retain access to the approved tokens after the fraudulent page disappears.
Unused signed permits may not appear in an approval checker before activation. Users who signed these spending authorizations should also follow Revoke.cash’s guidance on canceling them before an attacker uses them.
Revoking an approval can block further transfers under that permission, but it cannot reverse funds already taken.
Across Promises Compensation as Researchers Trace Losses
Blockchain research firm Bitquery estimated that approximately $348,000 was taken from nine wallets across five networks. One Aave depositor accounted for about $305,000 of that total after signing a malicious permit, according to its investigation. Across has not published its own confirmed loss total or victim count.
The bridge’s reimbursement commitment was explicit:
“All affected users will be made whole.”
Across also promised a full post-mortem in the coming days. Its restoration statement did not set out a payment timetable or detailed compensation process.
