Across, a crypto bridge that moves tokens between blockchains, was hit through its web address rather than its code. On the evening of Tuesday 10 November, attackers took control of the across.to domain and redirected visitors to a convincing phishing page, according to CryptoTicker. Security firm GoPlus estimates losses at just under $350,000, spread across six blockchains. Across has recovered the domain and promised to fully compensate everyone affected.
How it happened. Across attributes the incident to a social engineering attack against Namecheap, the registrar where the domain is managed. In this kind of attack, criminals trick people, for example by posing as the account holder to get support staff to change credentials. Across says the domain had the usual protections and will share details in its post-mortem. Namecheap had not commented publicly, according to the available information, although its founder Richard Kirkendall responded on X, helped secure the account and opened an investigation.
Fast response. According to crypto.news, Across was alerted in under 15 minutes. Security group SEAL 911 got major wallet providers to flag across.to as phishing, and Cloudflare marked the domain as dangerous and removed its DNS records. By Wednesday morning Across said the domain was back under its control.
What was stolen. GoPlus says wallets on Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma were hit. The fake page used token approvals, off-chain EIP-2612 permit signatures and Permit2 authorisations, and in some cases led victims to send crypto directly to attackers. According to Cointelegraph, one user reported losing 9,000 USDC and another 7,053 USDT0, figures that have not been independently confirmed.
Why it matters
Contracts safe, front end not. Across says the bridge's smart contracts and liquidity were not affected, nor were API users or third-party apps routing through Across. Only people who signed something on the fake site during the hijack lost money. The case follows another incident earlier in November in which attackers seized domains via registrar Name.com and planted a drainer on twelve DeFi websites. A bookmark offers no protection when the correct address itself points to the attacker.
- If you visited across.to on 10 or 11 November, check your approvals with Revoke.cash or Etherscan's Token Approval Checker.
- Look for approvals dated those days, unknown addresses and unlimited amounts, and revoke them.
- If you signed a permit on the fake page, move remaining funds to a new address: unused permits do not show up in approval lists.
- Save wallet addresses, transaction hashes, times and screenshots to support a claim.
- Ignore fake refund pages and direct messages; no genuine compensation process asks for your seed phrase.
All affected users will be made whole.
What comes next. Across has not yet published its own loss figure, the number of victims or a formal claims procedure. It warns that some wallets and browsers may keep flagging the real site as phishing for a while because of the blocklists used during the attack.
Source: CryptoTicker.io
Leave a Reply