Across Protocol’s official domain, across.to, has been successfully recovered and returned to developer control on Wednesday, Nov. 11, 2026. All systems are now operating normally after the cross-chain bridge site was briefly hijacked through a social engineering attack and redirected to a phishing page.
In the decentralized finance landscape, Across Protocol ranks third on DefiLlama in the cross-chain bridge category, trailing directly behind Circle and LayerZero. The protocol processed roughly $5.9 billion in transfer volume over the past 30 days.
How the Attackers Took Over the Domain
The timeline of the attack began when the perpetrators gained control of the domain on Tuesday at around 18:45 UTC by manipulating a Namecheap registrar account. The incident stemmed from social engineering targeting the domain administrator rather than an exploit of vulnerabilities in the protocol’s smart contracts, leaving the on-chain asset-locking code fully intact.
A rapid response was initiated once the irregularity was detected. The internal security team identified the anomaly within 15 minutes and immediately took action to bring down the website before coordinating externally.
Web3 emergency security response group SEAL911 helped flag the across.to domain as a malicious site across major crypto wallet applications. At the same time, Cloudflare placed the domain on a high-risk list and removed DNS records to cut off visitor access to the phishing server.
Domain control was regained thanks to direct assistance from Namecheap founder Richard Kirkendall. Technical support from the registrar’s leadership enabled the Across team to restore administrative access and bring all systems back to normal.
Smart Contracts Safe, Web Victims Reimbursed
Developers confirmed that third-party integrations and API users were completely unaffected by the hijacking. The risk of loss was confined solely to web interface users who connected to the malicious address before blocking measures were completed.
The Across team reaffirmed its commitment to full refunds for victims who interacted with the phishing site. “All affected users will be fully reimbursed. We will share a full post-mortem in the coming days,” the team stated in its official announcement.
For users in the DeFi ecosystem, the incident serves as a reminder that security threats are not confined to blockchain smart contract vulnerabilities. The manipulation of domain registrar accounts demonstrates that the web interface layer demands equal caution before transactions are signed.
Reported via Cointelegraph.
Previously: Across Urges Users to Avoid App - Wallet Balances Drained Following Bridge Interaction
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
