Across Protocol Restores Website After Phishing Attack, Losses Estimated at $350K

Across Protocol has its domain back. The bridge said on X at 01:16 UTC on Wednesday that it was "fully restored, and all systems are operational," about six and a half hours after an attacker seized across.to on Tuesday, November 10, and pointed visitors at a phishing page.

The damage has a number attached, but not one Across has confirmed. Security firm GoPlus Security estimated user losses at $350,000, spread across Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma. Across has not published a loss figure of its own, and neither the total losses nor the number of affected users has been disclosed.

• The news: Across regained control of across.to and says all systems are operational.
• The key figure: GoPlus Security estimates $350,000 in losses from the November 10 phishing attack, across six chains, and Across has not confirmed it.
• What happens next: Across has promised a full post-mortem and says all affected users will be made whole, without saying how or when.

A Registrar Handed Over the Domain

Across traced the takeover to its domain registrar. The team said a social engineering attack on Namecheap gave a bad actor control of the across.to domain, and that Namecheap had been unresponsive despite the protocol's efforts.

The attacker never touched the bridge's smart contracts. Instead, they manipulated the website's domain settings and served a page built to look like the real Across, so the site visitors saw was the fake one.

The Phishing Page Asked for Approvals, Not Deposits

GoPlus said the fake page got users to sign token approvals, including EIP-2612 permits and authorizations for Permit2, which the attacker then used to pull funds. A permit grants spending rights through an offchain signature, so a wallet can be drained without the victim confirming a separate transfer.

Across said it learned of the attack within 15 minutes and moved to take the site offline. SEAL911, a crypto security emergency hotline, flagged the address to major wallets as a phishing site, while Cloudflare helped label the domain risky and then stripped its DNS records. The protocol also suspended its frontend and API services during recovery.

$350,000 Is GoPlus's Number, and Users Are the Gap

The $350,000 is a security firm's estimate, not a protocol figure that Across has stood behind. Individual losses are circulating as posts on X, including $9,000 in USDC and 7,053 USDT0 across seven transactions on Plasma, but those claims have not been independently verified, and Across has not confirmed them either.

That leaves the size of the hit as the story's softest part: a credible third-party estimate, no confirmed total, and no confirmed count of how many people were caught.

What to Do If You Connected a Wallet

Across asked anyone affected to message it with transaction details and to revoke permissions granted to the attacker. It pointed users who connected wallets during the attack to Revoke.cash to review and revoke authorizations granted on November 10. Third-party integrations and developers using its API were not affected, the team said.

Across had warned users to stay off its app and avoid signing anything on Tuesday while the hijack was live, the warning we covered as it happened.

"All affected users will be made whole. We'll share a full post-mortem in the coming days," Across said. The team also thanked Namecheap founder Richard Kirkendall "for responding on X, helping us secure our account," and for opening an investigation.

Namecheap's Two Appearances in the Story

Across's account of its registrar shifted during the incident. Early on, it said Namecheap had been unresponsive. By the time the domain was back, it was thanking the registrar's founder for stepping in on X and opening an investigation.

How the attacker talked their way into the account is still unexplained. Across said the post-mortem would cover how the takeover was possible, and that its domain had been locked down with established security controls, so the unauthorized takeover should not have been possible.

The Bridge Behind the Phishing Page

Across is not a small target. DefiLlama data placed it among the leading cross-chain bridges by transaction activity, with roughly $5.9 billion in transfers over the preceding 30 days, third behind Circle and LayerZero.

That figure describes the bridge's normal flow, not the incident. The weak point was the domain, not the contracts that move the money, which is why the protocol could be back online while a loss estimate still sits unconfirmed.

November Is Not July

The domain attack is separate from a July incident involving Across's Risk Labs-operated relayer on Solana. In that case, attackers fabricated 1,627 Solana deposit events with a combined stated value of $41.7 million. The relayer processed 581 fraudulent requests before it was suspended, leaving a net loss of less than $4 million once trapped attacker funds were counted.

Both incidents hit Across's front door rather than its code, but they are unrelated events and should not be read as one total.

What Comes Next

The open questions now sit with Across's promised post-mortem: how the registrar account was compromised, how much was actually lost, and how the make-whole payments will work. Until that lands, the $350,000 stands as an outside estimate.

If you signed anything on across.to on November 10, the approvals you granted are still the thing to check, whether or not Across's write-up arrives first.