The short version
- Across Protocol lost its across.to domain for more than six hours on November 10 after a social engineering attack on its registrar Namecheap; visitors saw a phishing copy of the app.
- The bridge contracts, the API and apps built on Across were not hit; Across says only people who used the website from about 18:45 UTC that evening may be affected.
- Anyone who connected a wallet then should revoke that day’s approvals on revoke.cash; Across says all affected users will be made whole and a post-mortem is coming.
An attacker took control of across.to on Tuesday evening, November 10, and pointed the website of the cross-chain bridge Across Protocol at a phishing copy of the app. The bridge contracts were never touched. The way in was a social engineering attack on Namecheap, the company Across uses to register the domain.
The first warning went out at 19:05 UTC (2:05 p.m. in New York), about 20 minutes after the takeover began, telling users not to visit the app, connect a wallet or sign anything there:
🚨 ALERT 🚨
We're currently investigating an issue with the Across domain. Do NOT visit the app, connect your wallet, or sign any transaction or approval there until further notice.
We will post updates as we have them.
The site is back now. For anyone who bridged that evening, the question is simpler: did you sign something you shouldn’t have, and what do you do about it?
What Happened to the Across Protocol Domain?
The attacker talked their way into the registrar account that controls across.to, then sent its visitors to a fake page built to drain wallets.
In its incident write-up at 22:13 UTC, Across said the takeover started around 18:45 UTC and the team knew within 15 minutes. The security group SEAL911 got the fake site flagged as phishing in the big wallets, and Cloudflare pulled the domain’s DNS records, the settings that tell browsers where a website lives. Some visitors may have been hit before those blocks kicked in. People using Across through its API or through other apps built on it were not affected, the team said.
The frontend and API stayed offline for hours, and Across got the domain back only after Namecheap’s founder answered on X. At 01:16 UTC on Wednesday, Across posted that it was fully restored:
A full post-mortem is promised “in the coming days.” Across hasn’t said how much was taken or how many wallets signed on the fake page.
Sponsored · Affiliate link
Save 20% on fees trading on WEEX
Base Camp may earn a commission if you sign up. It never affects what we write.
Who Needs to Revoke Approvals?
Anyone who connected a wallet to across.to on November 10, from about 18:45 UTC until the site went dark, should revoke approvals from that evening. If you bridged on earlier days, or only through another app or the API, Across says you weren’t exposed.
A wallet-drainer page doesn’t need your seed phrase. It asks you to sign a token approval or a “permit” message that looks like a normal step in a bridge transfer. Once signed, the attacker’s contract can move those tokens whenever it likes, even after you close the tab. Fixing the website doesn’t cancel that permission.
Across’s own advice to users is to go to revoke.cash with the wallet they connected and revoke any approvals granted that day. It takes a few minutes:
- Open revoke.cash and connect the same wallet. Check every network you used that day.
- Sort by date. Anything from November 10 that you don’t recognize goes first.
- Revoke it. Each revoke is a small onchain transaction, so keep a little gas on each chain.
Tokens already moved can’t be revoked back. For those, Across says to DM its account on X and adds that “all affected users will be made whole.” Fake “Across support” accounts tend to appear within hours of a story like this, so only write to @AcrossProtocol and never share a seed phrase with anyone who replies to you.
SIDE TRAIL: Protecting Your Crypto Accounts: 2FA, Passwords and Phishing
Why Hardware 2FA Didn’t Save the Domain
The attacker seems to have gone around the lock. Across co-founder Hal wrote on X at 23:15 UTC that the Namecheap account “was locked down with hardware 2FA,” and that the team still couldn’t reach Namecheap after more than five hours:
Does anyone have a contact at @Namecheap? Their security and abuse team is unresponsive to us re: Across for hours.
Details:
– Our Namecheap account was locked down with hardware 2FA.
– An attacker socially engineered around this???
– We shut down the domain with @Cloudflare's
How that happened is the open question for the post-mortem. Social engineering usually means people: a convincing story told to a support desk can move a domain without anyone touching the account’s password.
That is the uncomfortable part for DeFi. A bridge can spend years on audits and still lose its front door through a support desk it doesn’t run. For users, a familiar web address is no guarantee. Read what a wallet pop-up asks for before you sign it.
TRAIL MAP: The 10 Most Common Crypto Scams and How to Spot Them
ACX Price After the Attack
The market barely reacted. ACX, the Across Protocol token, trades at $0.04254 at the time of writing, down 3.4% over 24 hours, with a market cap of about $30 million. It sits just above its 200-day moving average at $0.04117 and the $0.04100 support level, with $0.04300 as the first resistance.
The post-mortem should explain how a hardware key got bypassed. Until then, any approval signed on across.to on Tuesday night stays live until you revoke it.
VikingXBT has been trading crypto since 2017. The focus is futures, onchain data and automation. Onchain flows get checked before a chart is trusted, and anything repetitive gets automated. VikingXBT built Base Camp's own onchain scanner, which flags bundlers, snipers, dev holdings and wallet clusters in one view, and backtests strategies before trading them.
More from VikingXBT
