Security firm GoPlus estimates nearly $350,000 of user losses across six chains, and Across says its smart contracts were never touched. The protocol has promised to make affected users whole without saying how many there are.
Across Protocol says attackers took control of the domain behind its website on November 10 and used it to serve a page that imitated the bridge and drained visitors' wallets. The cross-chain bridge says its smart contracts were never exploited, and that the takeover began at about 18:45 UTC and set off an alert within 15 minutes.
Across suspended its frontend and its API and warned users not to open the app or connect their wallets while it investigated, telling them to avoid signing transactions or approvals until further notice. Cloudflare classified the domain as dangerous and stripped its DNS records, and the security collective SEAL911 flagged across.to as a phishing site, according to crypto.news. Cointelegraph, which carried the warning on the evening of November 10, said Across did not answer its request for details at the time.
The protocol attributes the takeover to a social engineering attack on Namecheap, the registrar that holds its domain. That route does not require breaking anything on the bridge itself. Whoever controls a domain's registrar account can repoint it at a server of their choosing, so visitors typing the familiar address reach the attacker's page while the contracts that actually move funds sit untouched on-chain. Namecheap has not publicly described what happened on its side.
Security firm GoPlus estimates that nearly $350,000 left users' wallets, spread across Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma. Victims are reported to have signed EIP-2612 permits, Permit2 authorizations or ordinary token approvals, and in some cases to have sent funds straight to attacker addresses. All three of those signature types hand a named spender the right to move a token on the signer's behalf, which is how a convincing copy of a bridge interface can empty a wallet without ever touching its private key.
Across says API users and third-party integrations were not affected, and that people who had used the site before the takeover were not either. It has not published its own loss estimate or said how many users were caught, so the GoPlus figure is the only number attached to the incident.
Across said on November 11 that the site was restored and its systems were operating normally. It has promised that affected users will be made whole and that a full post-mortem will follow in the coming days. The protocol said at first that Namecheap had not replied to its requests, and later credited the registrar's founder, Richard Kirkendall, with helping it secure the account and open an investigation.
It is not the first security incident Across has disclosed this year. In July its Solana deployment was attacked at around 05:30 UTC, a loss that landed on the Risk Labs relayer rather than on user deposits. What differs this time is where the failure sat. In July the bridge's own machinery was abused; in November the bridge worked as designed while its web address pointed somewhere else.
The pattern is well established. CoW Swap shut down its front end in April after the DNS records for cow.fi were altered at 14:54 UTC and a counterfeit interface began harvesting approval signatures. Curve Finance lost about $575,000 in 2022 when its nameserver was compromised rather than its contracts. Polymarket paused trading in October after malicious code reached users through a web performance monitoring script, a different entry point with the same effect.
A smart contract audit says nothing about this class of attack. The code that holds and routes funds can be reviewed line by line and remain irrelevant to a user who was never talking to it, because the browser sent the approval somewhere else. The defense sits with registrar account security, DNS configuration and the user's own habit of reading what a signature grants, and none of those are what an audit examines.
For users the exposure does not end when the domain comes back. An ERC-20 approval stays in place until the holder changes it, so a signature given to the phishing page remains usable afterward. Across pointed users to Revoke.cash in its security guidance, a tool that lists a wallet's outstanding approvals and lets the holder cancel them.
What the incident cost in total is still unsettled. Across has committed to reimbursement without naming a figure, the GoPlus estimate covers six chains but remains an estimate, and the registrar at the center of the protocol's account of events has said nothing in public.
