Across Protocol Restores Website After Domain Hijack Attack

Cross-chain bridge Across Protocol, which processed roughly $5.9 billion in transfers over the past 30 days, says it has regained full control of its official website as of Wednesday, November 11, after attackers hijacked its domain a day earlier. The team confirmed the recovery in a post on X, stating all systems are now working normally.

The breach began Tuesday around 18:45 UTC, when a social engineering attack targeted Namecheap, the domain registrar Across uses for across.to. Through that attack, hackers gained control of the domain and replaced the legitimate site with a phishing page designed to mimic the real Across app.

Across said its team was alerted within just 15 minutes of the hijack and immediately moved to shut down the compromised website. That speed mattered: in DeFi, every extra minute a phishing page stays live increases the chance more users unknowingly sign malicious transactions on a fake interface.

How the site was recovered

Regaining control of the domain required direct help from Richard Kirkendall, Namecheap's founder, who personally assisted Across in taking across.to back from the attackers. Security response group SEAL911 also helped by flagging the domain as phishing across major wallet providers, allowing wallets to automatically warn users attempting to visit the site.

Cloudflare, which handles network infrastructure for the domain, marked the site as at risk and subsequently removed its DNS records, effectively cutting off access to the phishing page even while the domain remained in the wrong hands for a period.

Despite the recovery, Across acknowledged that some users who visited the domain before the malicious site was fully blocked may have been affected. The team emphasized that third-party integrations and API users were unaffected, since the attack was isolated to the website domain layer rather than the protocol's smart contracts or core infrastructure.

A promise to make users whole

In its X post, Across wrote that all affected users will be made whole and that a full post-mortem will be shared in the coming days. The protocol has not yet disclosed the total amount lost or how many wallets were drained as a result of the phishing site.

Before the recovery announcement, Across had issued a warning on Tuesday urging users to avoid its app entirely amid reports of drained wallets, an early signal that this was more than a routine technical glitch and carried real financial risk for users who interacted with the fake site.

Why Across was a high-value target

Across is not a minor bridge. According to DefiLlama, it ranks third by 30-day transfer volume among cross-chain bridges, behind only Circle and LayerZero, having processed approximately $5.9 billion over that period. That scale explains why the domain hijack drew significant attention across the crypto community, given the large number of users potentially exposed to the phishing page.

For readers less familiar with the space, cross-chain bridges like Across move assets between different blockchains, for example from Ethereum to a layer-2 network or back. Because they handle large and constant volumes of value transfer, bridges are frequent targets for attackers, whether through smart contract exploits or, as in this case, weaknesses outside the code itself, such as the domain registrars and infrastructure that users rely on to reach the app.

Social engineering, not a smart contract bug

What sets this incident apart from many prior DeFi hacks is where the attack landed. Rather than exploiting a flaw in Across's smart contracts, attackers went after Namecheap as a third-party service provider. Social engineering refers to manipulation tactics aimed at people rather than systems, such as impersonating authorized staff or exploiting weak identity verification, to gain access without any technical hacking of the code itself.

This pattern is a reminder that DeFi protocol security extends beyond code audits to the surrounding service chain, including domain registrars, DNS providers, and official social media accounts. A single weak point outside a development team's direct control can be enough to expose users to phishing, even for protocols that have been repeatedly audited at the code level.

What it means for traders

Anyone who interacted with Across should keep an eye on the protocol's official X account for updates on the post-mortem and any reimbursement process. It's also worth reviewing wallet transaction history for anyone who accessed across.to between Tuesday afternoon and Wednesday, to check for any suspicious token approvals left behind, using a tool like revoke.cash.

More broadly, the incident underscores the importance of verifying official protocol URLs through trusted channels like verified social accounts or official documentation, rather than relying on search results or old bookmarks, since a domain's security status can change within minutes as happened here. Following alerts from security groups like SEAL911 can also serve as an extra safeguard before signing any transaction on a DeFi platform, particularly while a security incident is still unfolding.