Across Domain Hijack: Restored, Reimbursement Promised
Quick answer. Across says an attacker took across.to on November 10 by socially engineering registrar Namecheap, then sent users to a phishing site. Across said at 01:16 UTC on November 11 that it had restored the domain, and promised full reimbursement. Losses are unconfirmed.
Video transcript
An attacker took Across Protocol's domain by socially engineering its registrar, Namecheap, and sent users to a phishing site. Across says it has restored the domain and promised reimbursement, but losses are unconfirmed.
The takeover began around eighteen forty-five UTC on November tenth. Bitquery traced drains until twenty-one fifty-three. At one sixteen UTC the next day, Across said it had regained control.
GoPlus estimated nearly three hundred fifty thousand dollars across six chains. Bitquery traced about three hundred forty-eight thousand from nine wallets, a stated floor. Across has not disclosed a total.
Restoring the domain does not reverse transfers victims already authorized. Bitquery warns signed permits may stay usable even when approval lists look clean.
If you connected during the hijack, revoke unfamiliar approvals, including Permit and Permit two allowances. Report losses only through official Across channels, and ignore refund offers in direct messages.
Co-founder Hart Lambur said the Namecheap account had hardware two-factor protection. If so, login protection alone was not enough. The registrar belongs inside the wallet perimeter.
Neither Across disclosure describes a contract exploit. This was a domain and frontend incident, so Guardian's guide to offchain security treats the registrar and DNS account as part of the wallet perimeter.
Read the full article for every check. Guardian Managed Security includes Sentry monitoring of domains, DNS and certificates. Talk to us about your registrar exposure.
What Happened
An attacker took control of across.to, the Across Protocol domain, at about 18:45 UTC on November 10, 2026. Across says the way in was social engineering against its registrar, Namecheap. Across Protocol, Cointelegraph, crypto.news
Visitors who typed the right address were redirected to a phishing site. At 01:16 UTC on November 11, Across said the domain was back under its control and systems were operational.
Across has promised to make every affected user whole and to publish a full post-mortem. It has not released a loss total, an affected-user count or a payment schedule.
Across said third-party integrations and API users were unaffected. Exposure was limited to people who reached the malicious frontend before blocking completed.
That makes this a domain and frontend incident. Neither Across disclosure describes a contract exploit.
Timeline
All times are UTC. They come from Across's posts and Bitquery's onchain trace. Across Protocol, Bitquery
Bitquery's traced drains ran from 19:02 to 21:53. A drain time is not a visit time: in Bitquery's largest case, a permit signed on the site was used soon after 20:00.
| When (UTC) | Event |
|---|---|
| Nov 10, ~18:45 | Attacker gains control of across.to via Namecheap social engineering |
| Nov 10, within 15 minutes | Across is alerted and starts taking its frontend and API offline |
| Nov 10, 19:02 | First drain in Bitquery's trace |
| Nov 10, 21:53 | Last drain in Bitquery's trace |
| Nov 10, 22:13 | Across posts its disclosure and revoke guidance |
| Nov 11, 01:16 | Across says the domain is restored and systems are operational |
Response and Containment
At 22:13 UTC, Across said Namecheap had been unresponsive, so its frontend and API would stay down until the domain was secured. Across Protocol
It used SEAL911 and Cloudflare to flag the phishing site and remove its DNS records. Cointelegraph, crypto.news
Namecheap founder Richard Kirkendall helped secure the account, Across said, and an investigation has been opened.
Across co-founder Hart Lambur said publicly that the Namecheap account was protected by hardware 2FA. He also said the attacker changed the nameservers. AltcoinReporter
Lambur questioned how social engineering got around that protection. His posts give Across's side, not a Namecheap finding.
Kirkendall replied that someone was handling the case. He said the domain would stay locked while the earlier settings were restored.
Namecheap has not said how the social engineering worked, and Across's post-mortem is still pending.
What the Losses Look Like
GoPlus estimated nearly $350,000 in losses across six chains: Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma. crypto.news
Bitquery separately traced about $348,000 from nine wallets on Ethereum, Arbitrum, Base, BNB Chain and Optimism. Bitquery
Most of Bitquery's total came from one wallet. A single Aave depositor accounted for about $305,000.
Bitquery found the stolen funds split 80/20 between the drainer operator and a fee wallet.
Bitquery calls its figure a floor. It excludes unsupported chains, unpriced tokens and drains that used other payout paths.
The two figures cover different chains and use different methods.
| Source | Figure | Chains | Status |
|---|---|---|---|
| GoPlus | Nearly $350,000 | Ethereum, Arbitrum, Base, BNB Chain, Ink, Plasma | Estimate; not confirmed by Across |
| Bitquery | About $348,000 from nine wallets | Ethereum, Arbitrum, Base, BNB Chain, Optimism | Stated floor |
| Across | Not disclosed | Not disclosed | Post-mortem promised |
Why Restoring the Domain Is Not the End
Getting the domain back stops new visitors from reaching the fake site. It does not reverse transfers that victims had already authorized.
Across told users who connected during the incident to review and revoke token approvals, including permits. Across Protocol
Bitquery adds a caveat: signed permits may stay usable even when a wallet's ordinary approval list looks clean. Bitquery
Our explainer on Permit2 phishing shows how to read a permit request and cancel one before it is used.
The guidance covers November 10 visitors who connected a wallet, approved a token, signed a message or permit, or sent a transaction. DeFiPrime
Across asked loss reporters to contact its official account with a wallet address and transaction hashes. Daily Crypto Briefs
As of 04:03 UTC on November 11, Across had published no claim-validation rules, reimbursement start date or payment date.
Checks for Users
If you used Across while the domain was hijacked, work through these steps. If tokens already moved, follow our first-hour checklist for a drained wallet.
- Check whether you connected a wallet to across.to after about 18:45 UTC on November 10. Across Protocol
- Review and revoke unfamiliar token approvals on every chain you used with Across.
- Look for Permit and Permit2 allowances too, not just standard approvals. Bitquery
- If you signed a permit you cannot account for, move the remaining tokens to a fresh wallet.
- Report what happened to Across only through its official channels.
- Ignore direct messages offering refunds or recovery help, and never share a seed phrase.
What Protocol Teams Should Change
Treat the registrar and DNS account as part of the wallet perimeter, as our guide to offchain security does. Whoever controls the name controls what users are asked to sign.
If Lambur is right about hardware 2FA, login protection alone was not enough. A support process that can override it belongs to the same perimeter.
The pattern is not new. The CoW Swap DNS hijack explained walks through an earlier takeover that ran through a domain registry.
Our comparison of the most secure domain registrars scores providers on registry lock and hardware-key login.
For the full set of controls grouped by layer, use our DeFi DNS hijack prevention checklist.
- Apply a registry lock to every domain users transact through, where the TLD supports one.
- Protect registrar and DNS accounts with hardware security keys, and remove SMS fallbacks.
- Ask your registrar how support verifies identity before account recovery or nameserver changes.
- Alert on nameserver, registrar, record and certificate changes, from monitoring that does not depend on the domain.
- Keep a status page and warning channels hosted off the domain.
- Save registrar security contacts and your SEAL 911 route before you need them.
- Prepare a revoke notice template that names attacker spenders and affected chains.
Frequently Asked Questions
Can I use across.to again?
Across says wallet or browser phishing warnings on the domain may linger for a while after restoration. It also says people who used the frontend only before the attack are not affected. crypto.news
Will Across ask for my seed phrase?
No. Across said it would never ask for a seed phrase or private key. Treat any request for either as a scam, even one that appears to come from Across. Daily Crypto Briefs
What records should affected users keep?
Beyond the wallet address and transaction hashes Across requested, note the chains, the spender you approved and when you visited. Keep copies for whatever claim process Across sets out. Daily Crypto Briefs
Related reading
- cow swap dns hijack explained
- defi dns hijack prevention
- permit2 phishing
- most secure domain registrar
- crypto wallet drained what to do
Sources
- Across Protocol: Across restoration announcement
- Across Protocol: Across incident disclosure
- Across Protocol: Across wallet recovery guidance
- crypto.news: Across Protocol restores website after phishing attack, $350K in estimated losses
- Cointelegraph: Across Protocol restores website after hackers hijack domain
- Bitquery: Across Protocol Domain Hijack: $348K Drained From 9 Wallets
- Guardian: Potential DNS Rebinding Vulnerability (TOCTOU)
- Guardian: What Is Offchain Security? The Attack Surface Audits Miss
- AltcoinReporter: Across Protocol Domain Hijacked Through Namecheap Despite Hardware 2FA
- Daily Crypto Briefs: Across Protocol Pledges Repayment After Domain Hijack
- DeFiPrime: Across domain takeover: frontend offline, approvals at risk
- 0xCERT: Across across.to domain hijacked via registrar social engineering; drainer approvals still open on six chains
Watch the names that lead users to you
Managed Security includes Sentry monitoring of domains, DNS and certificates, Shield testing of internet-facing names, and a Guardian engineer on every alert. Talk to us about your registrar and DNS exposure.