across domain hijack: Namecheap Attack Turns Bridge Site Into Drainer
The across domain hijack let an attacker take over across.to via a social engineering attack on Namecheap at ~18:45 UTC Nov 10; Across has the domain back and says all affected users will be made whole.
- Across says the takeover started around 18:45 UTC, it was alerted within 15 minutes, and SEAL911 plus Cloudflare helped block the fake site.
- Security firm GoPlus estimated user losses at about $350,000 across Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma, according to CoinNess. Across has not published its own total.
- Third-party integrations and API users were not affected, per Across. A full post-mortem is promised "in the coming days."
in this block
The across domain hijack turned one of DeFi's busiest bridges into a phishing trap for a few hours on Tuesday: an attacker social-engineered the registrar Namecheap, took over across.to at about 18:45 UTC on November 10 and swapped the real app for a wallet drainer. Across says it has the domain back, systems are normal and "all affected users will be made whole."
What actually happened
Across is a cross-chain bridge that moves assets between Ethereum and other networks. DefiLlama data cited by Cointelegraph ranks it third by 30-day transfer volume, behind Circle and LayerZero, with about $5.9 billion processed in that window. That kind of traffic makes its front end a juicy target.
On Tuesday evening, Across posted on X telling users not to open the app, connect wallets, or sign transactions or approvals until further notice. At first it did not say what was wrong. Users quickly filled in the blanks: one claimed a $9,000 USDC loss, another said 7,053 USDT0 left their wallet over seven transactions on Plasma, and a third said they were drained after bridging. Cointelegraph noted it had not verified those reports.
Across later explained the cause. An attacker ran a social engineering attack on its domain registrar, Namecheap, and gained control of the domain at about 18:45 UTC. The team says it got an alert within 15 minutes and moved to shut the site down. SEAL911, a volunteer security response group, flagged the domain as phishing with major wallets, and Cloudflare marked it as risky and later removed its DNS records. A PANews summary of the same update says Across also told users to revoke approvals with revoke.cash and kept its front end and API closed until the domain was secure.
On Wednesday, Across said across.to was back under its control with help from Namecheap founder Richard Kirkendall and that all systems were working normally.
Why the across domain hijack matters
Nothing here required breaking a smart contract. The contracts kept working. The weak link was the address bar. If an attacker controls the domain, they control what code your browser loads, and that code can ask your wallet to sign anything.
We have seen this playbook before. In the polymarket debugbear drain, a hijacked monitoring script on the front end drained wallets even though the core contracts were fine. The lesson repeats: a trusted URL is only as safe as the registrar account, DNS settings and third-party scripts behind it.
Giant exploits like the binance 6.3b hack grab the headlines, but front-end attacks are cheaper to pull off and hit regular users directly.
The fast response probably limited the damage. A 15-minute alert, wallet-level phishing flags and a DNS takedown are about as good as it gets once a domain falls. But anyone who signed an approval during the window may still have an open allowance, which is why revoking matters even after the site is fixed.
What we still don't know
Across has not published total losses, the number of affected wallets or how exactly the Namecheap account was compromised. The roughly $350K figure comes from GoPlus via CoinNess and could change once the post-mortem lands. The repayment process, timeline and eligibility rules are also not public yet.
What to do as a reader
If you used Across on November 10, check your wallet's approvals right now with a tool like revoke.cash and remove anything you do not recognize, especially allowances granted around the time of the across domain hijack. Then watch Across on X for the official post-mortem and claims process, and ignore DMs offering "refunds," which are a common follow-up scam.
More broadly, bookmark the front ends you use, read what your wallet asks you to sign, and keep big balances in a wallet that never connects to fresh dapps. Bridges are high-value targets, and this will not be the last registrar attack. Nothing here is investment advice. If funds are already gone, document your transactions and wait for official channels rather than paying anyone who promises recovery.
Not financial advice. DYOR, ser.
