Across Protocol Tackles Domain Hack After Phishing Attack
Across Protocol recently faced a critical security challenge after hackers successfully seized control of its official domain on November 10. This incident, which stemmed from a social engineering attack on the domain registrar Namecheap, redirected users to a fraudulent site designed to steal digital assets. While the team moved quickly to regain control, reports indicate that approximately $350,000 was stolen from various crypto wallets.
Across Protocol: How Social Engineering Compromised the Bridge
The attackers did not breach the underlying smart contracts of the bridge; instead, they manipulated domain settings to steer traffic toward a malicious destination. Because Across Protocol functions as a cross-chain bridge, trust in the frontend is essential for safe user interaction. According to GoPlus Security, the phishing page specifically targeted users on Ethereum, Arbitrum, Base, BNB Chain, Ink, and Plasma. By convincing users to sign EIP-2612 permits or token approvals, the hackers bypassed traditional security layers.
Across Protocol: Immediate Response and Mitigation Efforts
The response was swift once the intrusion was detected. Within 15 minutes of the initial alert, the team initiated a shutdown of frontend and API services to prevent further exposure. With assistance from the SEAL911 security collective, they flagged the fraudulent site. Cloudflare subsequently removed the associated DNS records to ensure no more traffic could reach the malicious server. By November 11, the Across Protocol team confirmed they had successfully regained full control of their domain.
What This Means for Future Security
This incident highlights a major vulnerability in decentralized finance: the reliance on centralized domain registrars. Even if a protocol has perfectly audited code, a failure at the registrar level can create a disaster for end users. The team has committed to making all affected users whole, promising a full post-mortem analysis in the coming days. Despite the domain hijacking, API and third-party integration users remained unaffected throughout the ordeal.
- Estimated losses: $350,000
- Primary attack vector: Social engineering at domain registrar
- Affected networks: Ethereum, Arbitrum, Base, BNB Chain, Ink, and Plasma
- Status: Frontend and API services fully restored
The Bottom Line for Crypto Users
For the average user, this serves as a reminder to verify URLs before signing any transactions. While Across Protocol acted decisively to restore its services, the damage to individual wallets underscores the need for better security standards across the industry. Users should remain cautious of any site requesting unusual token approvals, even if the domain appears legitimate at first glance.