Across Protocol Restores Operations After Malicious Domain Hijack

TL;DR

• Website Recovery: Across Protocol regained control of its domain after a social engineering attack allowed attackers to replace its website with a phishing page.
• Security Response: The protocol detected the incident within 15 minutes and worked with SEAL911 and Cloudflare to flag the malicious website.
• User Impact: The total number of affected users has not been disclosed. GoPlus estimated losses at around $350,000 from wallets across multiple networks.
  

  ---

A phishing attack that temporarily compromised the official website of Across Protocol has been contained after the team regained control of its domain and restored normal operations. Across Protocol said the incident stemmed from a social engineering attack targeting its domain registrar, leading to a malicious website that exposed some users to potential wallet-draining activity before the domain was taken offline.

Domain Takeover Led to Phishing Threat

The incident began at approximately 18:45 UTC on Nov. 10, when attackers gained control of the protocol’s official domain through a social engineering attack involving registrar Namecheap. According to Across Protocol, the compromised website was replaced with a phishing page designed to trick visitors into interacting with malicious content.

Earlier, Across Protocol said users should avoid the application after reports emerged of drained wallets linked to the fake website. The team at Across Protocol stated that it was notified of the takeover within 15 minutes and immediately began efforts to limit the impact and remove access to the malicious page. The protocol noted that the number of affected users and total losses have not yet been disclosed.

Rapid Response Helped Contain the Incident

After receiving the alert, Across Protocol initiated its response and coordinated with external security partners. Across Protocol worked alongside security response group SEAL911, which flagged the compromised domain as phishing with major wallet providers. Cloudflare also marked the website as potentially dangerous and later removed its DNS records, making the phishing page inaccessible.

Some visitors who reached the domain before those protections were fully implemented may have been affected, though Across Protocol noted that third-party integrations and API users were not impacted by the attack. Security platform GoPlus estimated user losses at roughly $350,000 and said stolen funds came from wallets across multiple blockchain networks. The phishing site reportedly encouraged users to sign fraudulent approvals and permits that enabled attackers to drain assets.

Operations Resume as Users Await Full Report

Later Wednesday, Across Protocol confirmed that control of the domain had been restored with assistance from Namecheap founder Richard Kirkendall. Across Protocol also stated that all affected users would be made whole and that a detailed post-mortem report will be released in the coming days. The event affected one of the largest cross-chain bridges by transfer activity. Data cited in the reports showed the bridge processed about $5.9 billion in volume over the past 30 days, placing it among the most active interoperability protocols in the sector.