Across domain hijack: Protocol restores systems after phishing attack

The Across domain hijack sent visitors to a phishing site after attackers took control of the cross-chain protocol’s across.to domain on November 10. Across said the site and normal operations were restored on November 11, and that it intends to make affected users whole. It has not confirmed total losses or a number of affected users.

What we know about the Across domain hijack

How the Across domain hijack unfolded

Cointelegraph reported that the attacker gained control of across.to at about 18:45 UTC on November 10, 2026, through what Across described as social engineering directed at its domain registrar, Namecheap. The compromised address redirected visitors to a phishing site. The Block also reported the registrar attack and said the protocol received an alert within 15 minutes.

Several outside services were involved in the response. According to The Block, SEAL911 helped flag the domain as phishing with major wallets, while Cloudflare later removed its DNS records, making the phishing site inaccessible. Across said it had regained control of the domain and restored normal operations by November 11, according to Cointelegraph.

The protocol said users of its API and third-party integrations were unaffected. It warned, however, that people who visited the compromised domain before it was blocked may have been affected.

Loss estimates differ slightly by source and scope. The Block said GoPlus estimated about $350,000 in losses across Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma. Bitquery’s separate on-chain investigation put the total at about $348,000, identifying nine wallets across five chains that were drained between 19:02 and 21:53 UTC on November 10. Bitquery attributed about $305,000 to one Aave depositor.

Those figures are third-party findings, not a confirmed Across accounting. The Block reported that Across had not independently disclosed a total loss or victim count. Cointelegraph said the protocol promised to make affected users whole and planned to publish a post-mortem in the coming days. The amount, process and timing of any reimbursement were not specified in the reports.

What is still unclear

The reports do not say how many people visited the phishing page or how many were affected. They also do not explain how the reported wallet losses map to individual users. The estimates cover different numbers of chains, so the approximate $348,000 and $350,000 totals should not be treated as a final figure confirmed by Across.

The reports describe the social-engineering attack targeting Namecheap but do not provide further details about how the registrar account was accessed. Across said it would publish a post-mortem in the coming days, which could provide additional information.

Across said users of its API and third-party integrations were unaffected. It also warned that some people who visited the compromised domain before it was blocked may have been affected.

Market data and broader sentiment

The market snapshot provides prices and 24-hour changes for major cryptocurrencies, but it cannot establish whether the incident affected those markets. CoinGecko’s data for November 11 at 12:13 UTC showed Bitcoin at $73,884, down 0.51% over 24 hours, and Ether at $2,053.40, down 1.74%. Those broad moves do not establish that the Across incident caused either change.

The Crypto Fear & Greed Index was 29, classified as Fear, on November 11. That offers broader sentiment context, not evidence of a market response to this specific attack.

The incident’s reach matters because Across is a sizable bridge by reported activity. Cointelegraph said it ranked third in 30-day bridge transfer volume, with about $5.9 billion processed, behind Circle and LayerZero. That figure describes transfer volume, not funds lost or a measure of security. Bitquery’s wallet-level investigation adds detail to the loss estimates, while Across’s promised post-mortem is a forthcoming source for the protocol’s own account.

What the Across domain hijack means for investors

The reports describe a domain hijack that redirected visitors to a phishing site. They do not report an exploit of Across’s bridge contracts. Across said its API and third-party integrations were unaffected, while warning that some visitors to the compromised domain may have been affected.

Across said it would make affected users whole, but the reports do not specify reimbursement eligibility, funding or timing. The Block reported that Across had not independently disclosed a total loss figure or victim count, so the reported estimates remain unconfirmed by the protocol.

A domain incident is distinct from an exploit of bridge contracts. The available reports focus on the domain redirect, the response to it and third-party estimates of wallet losses. They do not provide enough detail to determine how many visitors interacted with the phishing site or what actions they took.

The next reported update to watch is Across’s promised post-mortem. The available reports do not give a final loss or victim count, or details of the reimbursement plan.

Bottom line

Across says it has recovered across.to and restored normal service after a social-engineering attack targeting its registrar redirected visitors to a phishing site. Independent investigators estimate losses near $350,000, but the protocol’s post-mortem and reimbursement details are needed to establish the final impact.

Sources

• Crosschain protocol Across restores systems after domain hijack (The Block)
• Across Protocol restores website after hackers hijack domain (Cointelegraph)
• Across Protocol restores website after hackers hijack domain (cointelegraph.com)

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrencies are highly volatile; always do your own research before investing.