Across Protocol Restores Website After Attack: Damage Estimated at $350,000

The cross-chain protocol Across Protocol reported the restoration of its website after a phishing attack that occurred on November 10, 2026. According to the project, attackers gained control over the domain across.to and used it to redirect visitors to a fake page designed to steal cryptocurrency. The incident was accompanied by user reports of lost funds after interacting with the platform. On November 11, Across announced that it had regained control over the domain and resumed normal service operations.

The Across project allows the transfer of digital assets between Ethereum and other blockchain networks. During the investigation, the team recommended that users not open the application, connect crypto wallets, or confirm transactions or token management permissions. The warning was related to the risk of signing malicious operations that could give attackers access to users' assets.

Attackers gained control over the domain through Namecheap

According to Across's statement, the attack began on November 10 at approximately 18:45 UTC. The attackers used social engineering methods against the domain registrar Namecheap, resulting in the ability to change the project's domain settings. After this, users accessing the usual address could land on a phishing page that visually mimicked the real service.

The Across team reported receiving a warning about the incident within 15 minutes of the domain being hijacked and began blocking access to the fake site. SEAL911 response team specialists helped mark the address as phishing in the protection systems of major crypto wallets, and Cloudflare subsequently removed the corresponding DNS records. This allowed access to the malicious page to be stopped until full control over the domain was restored.

According to Across, the attack affected the web interface through which users interact with the protocol. Clients using third-party integrations and APIs were reportedly not affected. There was no information about the compromise of Across's underlying smart contracts.

User losses estimated at approximately $350,000

During the incident, several users reported the disappearance of cryptocurrency on the social network X. One of them reported the loss of 9,000 USDC, and another reported the theft of 7,053 USDT0 in the Plasma network as a result of seven transactions. Initially, Cointelegraph was unable to independently confirm these reports, and the Across team requested details of the operations from the claimants for investigation.

Subsequently, security platform specialists GoPlus estimated the total damage at approximately $350,000. According to them, the attack affected crypto wallets in the Ethereum, Arbitrum, Base, BNB Chain, Ink, and Plasma networks. A separate study by Bitquery revealed transfers amounting to about $348,000 from nine wallets across five blockchains, although the methodologies and coverage of the two assessments differ.

According to researchers, the fake page prompted users to confirm token transfer permissions. Such operations can allow a third-party address or smart contract to manage assets without obtaining the owner's private key. However, the final amount of damage and the number of affected users have not yet been officially disclosed by Across.

Across promised to compensate losses

On November 11, the Across team reported that control over the domain was restored with the assistance of Namecheap founder Richard Kirkendall. According to the project, all systems are once again operating normally, and the investigation into the circumstances of the domain takeover is ongoing. In the coming days, Across intends to publish a detailed report explaining the causes of the incident and the security measures taken.

“All affected users will be made whole,” the Across team stated on X. In translation: “All affected users will be fully compensated for their losses.” Specific timelines for payments and the procedure for confirming damages were not disclosed at the time of the statement.

Users who interacted with the site during the attack and signed suspicious operations were advised by the team to check permissions granted to third-party contracts and revoke them if necessary. The restoration of the website does not automatically cancel permissions previously granted through the phishing page.

The incident demonstrates that threats to cryptocurrency services can come not only from smart contract vulnerabilities but also from the compromise of external infrastructure. Even when the blockchain protocol remains operational, the takeover of an official domain can lead to financial losses for users interacting with a substituted interface.