Across Protocol Warns Users After Domain Hijack Sends Visitors to Phishing Site

If you used across.to on Tuesday evening, the question that matters is simple: did you sign anything? Across Protocol's bridge contracts were not attacked. The risk sits with people who visited the hijacked website after about 18:45 UTC on 10 November and signed a token approval or permit on what turned out to be a lookalike phishing page.

• An attacker took control of Across's domain through its registrar, Namecheap, and pointed visitors to a fake site while the bridge itself kept running.
• The hijack began at about 18:45 UTC on 10 November, and Across says it had the domain back by Wednesday, 11 November.
• Across says affected users will be made whole and has promised a full post-mortem in the coming days.

The Bridge Worked. The Front Door Didn't

It helps to picture Across as two parts. One part is the set of smart contracts that actually moves your tokens between chains. The other is the website, the screen where you choose a route and press a button. The attacker never touched the first part.

Across is reported to have said that a social engineering attack on Namecheap gave the attacker control of its domain. Instead of breaking the bridge's code, the attacker changed the domain settings so that people typing across.to were sent to a copy of the site built to drain wallets. How the attacker talked their way past the registrar is not yet known. That detail should come with the post-mortem.

That split is also why some users weren't affected at all. Across says third-party integrations and API users were unaffected, because they reach the bridge without going through the hijacked website.

What the Fake Page Asked You to Sign

The phishing page didn't need your seed phrase. It needed a signature. People who interacted with it could have been persuaded to sign one of three things:

• EIP-2612 permits, an off-chain signature that gives another address the right to spend a token.
• Permit2 authorizations, a similar spending permission handled through a shared approval contract.
• Direct token approvals, the standard on-chain permission that lets an address move your tokens.

All three look routine on a bridge, which is the trick. Approving a spender is a normal step before a transfer, so a request from a site that looks exactly like Across wouldn't seem strange in the moment.

Security firm GoPlus says the operation affected wallets on Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma. If you hold tokens on any of those networks and connected to across.to during the attack, check your permissions.

How to Check and Revoke Your Approvals

Across pointed users who connected wallets during the attack to Revoke.cash. There, they can review the authorizations they granted on 10 November and revoke any they don't recognise. Revoking removes the spending permission, so it can't be used later.

The window began at about 18:45 UTC on 10 November. Some visitors who reached the site before wallets and browsers started blocking it may have been affected. Security response group SEAL911 helped get across.to flagged as a phishing site with major cryptocurrency wallets.

On Tuesday, Across told users not to open its app or connect wallets while it investigated. It also paused its own frontend and API services during the recovery.

Losses Are Estimated, Not Confirmed

Nobody has an official total yet. Across hasn't said how much was lost or how many users were hit.

GoPlus estimates nearly $350,000 in losses across the six networks. Across hasn't confirmed that figure. Individual users on X have posted their own losses: one said they lost $9,000 in USDC, and another said they lost 7,053 USDT0 across seven transactions on Plasma. Those claims haven't been independently verified.

Domain Back, Post-Mortem Next

Across says across.to is back under its control after help from Namecheap founder Richard Kirkendall. Namecheap had not responded at first. Across's message to users was short: "All affected users will be made whole. We'll share a full post-mortem in the coming days."

The scale of the target explains why the incident drew attention. Across ranked third among bridges by 30-day transfer volume, behind Circle and LayerZero, with about $5.9 billion processed over that period, according to DefiLlama.

Two questions stay open until the post-mortem arrives: exactly how the registrar was fooled, and when compensation will reach the people who lost funds. In the meantime, if you signed something on across.to on 10 November, revoking it is the one step fully in your hands.