Across Protocol, a crosschain bridge, lost control of its website for several hours on Tuesday after an attacker talked their way past its domain registrar, Namecheap, and pointed across.to at a phishing page. Across says the problem was limited to its web domain, and users of its API and integrations were not affected. The takeover happened even though the team’s Namecheap account was protected with hardware two-factor authentication, according to its co-founder. Across blames the registrar, not its own setup.
What Across said happened
At about 18:45 UTC on Nov. 10, “a social engineering attack on @Namecheap (our domain registrar) gave a bad actor control of the Across domain,” Across said in its first detailed statement. The team said it was alerted within 15 minutes and moved to shut the site down. Security group SEAL 911 got across.to flagged as a phishing site in major wallets, and Cloudflare marked the domain as at risk before pulling its DNS records.
Some users who visited the site before Cloudflare fully blocked it “may have been affected,” the project said. Users of its API and third-party integrations were not, and neither were people who had visited the real site before the takeover. Across first told users to stay away from the app at 19:05 UTC, saying only that it was investigating an issue with its domain.
The team was blunt about the registrar. Its domain “was fully locked down with best-in-class security practices; this unauthorized takeover should not have been possible,” Across said, adding that Namecheap had been unresponsive and that its frontend and API would stay offline until the domain was secured.
Hardware 2FA, and five hours of silence
Across co-founder Hart Lambur went further. The team’s Namecheap account “was locked down with hardware 2FA,” he wrote a little after 23:00 UTC, asking publicly whether anyone had a contact at the company. “An attacker socially engineered around this???” He said the registrar’s security and abuse team had not responded for more than five hours.
The fix came through the same public channel. Namecheap founder Richard Kirkendall replied about an hour later: “We have someone on this now. Domain will remain locked but previous(before current changes) will be restored asap.” Lambur then asked for the domain’s original nameservers to be put back, saying the attacker had changed them. Just after 01:15 UTC on Wednesday, Across said it was “fully restored” and thanked Kirkendall for helping secure the account and opening an investigation into how the takeover happened. Namecheap has not said publicly how the takeover happened.
That detail matters for every DeFi team, not only Across. A hardware key protects the login, but it cannot help if a registrar can be talked into changing an account on someone else’s behalf. Lambur said he did not want to “draw any conclusions until we have all the facts.” When another user suggested moving to Cloudflare as registrar, Lambur replied that the team does that for other domains, but Cloudflare does not support .to. Across has promised a full post-mortem “in the coming days,” and the main question is which Namecheap process the attacker got through.
How much was lost
Across has not published a loss figure. It said “all affected users will be made whole” and asked victims to send transaction details by direct message.
In replies on Tuesday, one user said they lost $9,000 in USDC, and another said 7,053 USDT0 left their wallet in seven transactions on the Plasma network. Cointelegraph reported those claims but said it had not verified them. A total of about $294,000 has also been shared widely on X without a named source. AltcoinReporter could not confirm it, and the Ethereum address attached to one widely shared version of that claim is the ACX token contract itself, according to the Blockscout explorer, not an attacker wallet. Until Across or a security firm publishes traced figures, that number should be treated as unverified.
The second registrar incident in 11 days
The Across attack lands less than two weeks after domains managed by Name.com, a different registrar, were redirected to the Step Drainer phishing kit, hitting at least 12 DeFi sites. AltcoinReporter reported on Oct. 31 that Name.com confirmed the redirects but did not explain how they happened. In both cases the projects said their contracts were untouched. The damage came from users trusting a familiar web address.
For users, the advice is the same as it was then. Disconnecting a wallet does not cancel token approvals. Anyone who connected to across.to on Tuesday should check and revoke approvals granted that day with a tool such as Revoke.cash, which Across itself recommended, and should trust only the project’s official channels. Across warned against DMs or links from anyone else claiming to be the team.
FAQ
Was the Across bridge hacked?
Across describes it as a takeover of its website domain through Namecheap, not an attack on the bridge itself. It said API users and third-party integrations were not affected.
Who was at risk?
Users who visited across.to and signed transactions or approvals during the hijack on Nov. 10. Across says it will compensate all affected users.
Is Across safe to use now?
Across said early on Nov. 11 that the domain is back under its control and all systems are working normally. Some wallets may show a phishing warning for a while.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
