Across Protocol Regains Domain After Hijack, GoPlus Sees $350K Loss
Across Protocol has its across.to domain back after a November 10 hijack routed users to a phishing page. GoPlus estimates nearly $350,000 lost across six chains. Across has not confirmed the figure but says all affected users will be made whole.
Nearly $350,000 drained across six chains, by security firm GoPlus's count. Across Protocol says its across.to domain is back under its control as of Wednesday, a day after an attacker hijacked it and pointed users to a phishing page. Across has not confirmed the GoPlus figure.
The takeover began at about 18:45 UTC on November 10. Across blamed a social engineering attack targeting its registrar, Namecheap. The attacker changed the domain settings. The bridge's smart contracts were not exploited.
What Across and GoPlus say
Across said it was alerted within 15 minutes and moved to shut the website down. SEAL911 helped flag the domain as phishing with major wallets. Cloudflare marked it as at risk, then removed its DNS records. Across temporarily suspended its frontend and API services during recovery.
On Wednesday, Across said the domain was back under its control with help from Namecheap founder Richard Kirkendall. All systems are working normally.
GoPlus put losses at nearly $350,000 across Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma. Victims may have signed EIP-2612 permits, Permit2 authorizations or direct token approvals, or sent funds straight to attacker addresses, according to the firm. Across has not disclosed its own loss total or the number of affected users.
"All affected users will be made whole. We'll share a full post-mortem in the coming days."
Across Protocol team
Who is affected
Across said third-party integrations and API users were unaffected, as were users who accessed the site before the attack. Some users who visited before the malicious site was fully blocked may still have been hit.
Anyone who connected a wallet during the attack should use Revoke.cash to cancel approvals granted on November 10, Across said. That has limits. Revoking cannot reverse completed transfers, and some off-chain signatures may stay usable.
Open questions
Across said its domain was protected by established security controls. The takeover happened anyway. The post-mortem will have to explain how.
The response has a wrinkle too: Across first said Namecheap had not answered its requests for help, then thanked Namecheap's founder for his assistance.
Why it matters
Across processed about $5.9 billion over the preceding 30 days, per DefiLlama data, third by 30-day transfer volume behind Circle and LayerZero. Volume like that makes its domain a high-value target. Contracts stayed intact. Users lost funds anyway, through the registrar layer.
This incident is separate from a July episode involving a Risk Labs-operated Solana relayer, where attackers fabricated 1,627 deposit events worth a stated $41.7 million. The relayer processed 581 fraudulent requests, for a net loss under $4 million. Front-end hijacks are not new either: in a series of DeFi website hijackings reported October 31, Blockaid identified at least 12 sites serving the Step Drainer toolkit.
