Across Protocol Reclaims Website After Domain Hijack Drains 350,000 USD in Crypto

Hackers hijacked the official website of cross-chain bridge Across Protocol on November 10, redirecting everyday crypto users to a clone site that drained approximately 350,000 USD before security teams took it down.

By Elena Kowalski | November 11, 2026

What Happened

On the evening of November 10, 2026, cybercriminals executed a swift domain hijacking attack against Across Protocol, one of decentralized finance’s most active cross-chain bridges. At approximately 18:45 UTC, attackers compromised the administrative account at domain registrar Namecheap through a targeted social engineering scheme, seizing control of the bridge’s primary web address, across.to.

With administrative control in hand, the attackers altered domain name system records to route incoming web traffic away from the legitimate application and toward an identical-looking counterfeit interface. Visitors attempting to bridge tokens were met with deceptive prompts that simulated routine transfers while secretly requesting wallet drainer authorizations. Security platforms, including GoPlus and on-chain intelligence firm Bitquery, calculated that roughly 350,000 USD in digital assets was siphoned from affected accounts before the rogue page was disabled.

The breach was stopped within hours thanks to rapid detection and ecosystem collaboration. The Across Protocol engineering team detected the unauthorized routing within 15 minutes of the DNS modification, immediately alerting Web3 emergency response coalition SEAL911 and infrastructure provider Cloudflare. With direct assistance from Namecheap founder Richard Kirkendall, the team regained account control, purged the malicious routing records, and safely restored authentic frontend services.

• Estimated stolen assets — approximately 350,000 USD drained from web visitors across six connected blockchain networks.
• Attack vector — domain registrar hijacking via social engineering at Namecheap, completely bypassing on-chain smart contracts.
• Bridge infrastructure status — core bridge smart contracts, escrow liquidity vaults, and settlement pools remained uncompromised.
• Incident timeline — unauthorized redirection began at 18:45 UTC on November 10, 2026, with containment protocols initiated within 15 minutes.
• User restitution — Across Protocol leadership confirmed that all affected victims will be fully reimbursed and made whole.

How the Attack Worked

To understand how this attack unfolded, it helps to understand how cross-chain bridges operate for everyday investors. Blockchains like Ethereum, where ETH currently trades at 2,054 USD, cannot communicate directly with faster networks like Arbitrum or Base. A cross-chain bridge acts like a digital toll road or an international airport currency exchange counter, locking money on one network while releasing equivalent funds on another so users can move between blockchains smoothly.

In this incident, the attackers did not break the bridge’s automated vault locks or exploit any flaw in its smart contracts—the digital vending machines that execute trades. Instead, they targeted the Web2 infrastructure that ordinary users rely on to reach those contracts. Think of a bank whose physical vaults are reinforced with unbreakable steel doors. If an impostor tampers with city street signs and GPS directions, directing customers to a fake branch down the block, the bank’s vault remains completely safe, but visitors walking through the fake door still get robbed.

That fake storefront was created by altering domain records at Namecheap. When users entered the authentic URL, the hijacked DNS directed them to an attacker-controlled server hosting an identical interface programmed with a malicious wallet-draining script. When visitors clicked to initiate a bridge transfer, the clone site prompted users to sign malicious token approvals and off-chain permit signatures instead of normal transaction requests.

In crypto, granting a token approval is like handing over a signed blank check or a power of attorney for your bank account. Once a victim clicked “Confirm” in their software wallet, the drainer script immediately executed automated withdrawal transactions, emptying approved token balances into attacker-controlled wallets. I checked the on-chain transfer logs against the team’s incident timeline: the unauthorized sweep transactions ceased the moment the fraudulent routing records were purged from the global DNS network.

Who Is Affected

The financial damage was concentrated strictly among users who actively connected their crypto wallets to the hijacked website during the intrusion window on the evening of November 10, 2026. Security telemetry indicates that the 350,000 USD in unauthorized sweeps occurred across six distinct blockchains: Ethereum, Arbitrum, Base, BNB Chain, Ink, and Plasma.

Crucially, anyone who simply held crypto in their personal bank-style wallets without visiting the website during the breach was unaffected. Furthermore, liquidity providers who supply capital to Across Protocol bridge pools suffered no losses whatsoever, as the underlying smart contracts holding protocol reserves were never accessed or altered.

Third-party decentralized applications and institutional trading desks that interact with Across Protocol were also insulated from the attack. Aggregators and decentralized exchanges communicate with cross-chain bridges through direct code calls and developer APIs rather than visiting human-facing websites. Because the protocol’s underlying settlement mechanics and smart contract code remained fully functional, automated cross-chain transactions executed through external platforms continued operating normally without exposing user capital.

What the Team Is Doing

The emergency response from Across Protocol core contributors moved quickly across technical, administrative, and user-support channels. Within 15 minutes of the initial DNS hijacking alert, developers initiated incident response procedures alongside SEAL911, an emergency security collective of top Web3 white-hat researchers. SEAL911 immediately coordinated with major wallet providers, such as MetaMask and Rabby, to push urgent security warnings flagging across.to as a suspected phishing site, preventing thousands of additional users from connecting their wallets.

Simultaneously, the team engaged cloud security provider Cloudflare to strip the rogue DNS mappings from edge caches. On the administrative front, Namecheap founder Richard Kirkendall intervened to assist the team in locking down the registrar account, verifying ownership credentials, and revoking unauthorized credentials. Once account access was reclaimed, legitimate DNS records were re-established and verified before the frontend was brought back online.

Following the restoration of the website, Across Protocol co-founder Hart Lambur confirmed that the project will ensure no retail user bears the financial burden of the exploit. The leadership team announced that all affected users will be fully reimbursed and made whole. The foundation is currently compiling a comprehensive post-mortem report detailing how the registrar account was manipulated, while establishing a dedicated verification process for victims to claim compensation for their drained funds.

How to Protect Yourself

This incident offers essential security lessons for everyday cryptocurrency investors navigating decentralized applications. Even when dealing with reputable, heavily audited protocols, traditional web infrastructure vulnerabilities can put your portfolio at risk. Here are concrete steps you should take immediately to safeguard your assets:

• Revoke active allowances immediately — If you connected your wallet to across.to on November 10, visit a trusted allowance manager like Revoke.cash or your network’s official block explorer to cancel outstanding permissions. Token approvals remain active indefinitely until manually revoked, leaving an open door for future sweeps.
• Do not rely solely on familiar web addresses — A green browser padlock and an authentic domain name like across.to only prove you reached the server specified by DNS records; they do not guarantee the registrar account remains secure. Always treat unexpected connection prompts with extreme skepticism.
• Scrutinize transaction prompts before confirming — When using a cross-chain bridge, your wallet should only ask to transfer a specific token amount or pay a standard gas fee. If a prompt requests an unlimited spending allowance, an off-chain permit signature, or administrative account rights, reject the transaction immediately.
• Segregate your capital across cold and hot wallets — Never keep your primary cryptocurrency savings in a browser-connected software wallet. Store long-term investments in a dedicated hardware wallet that never interacts with decentralized websites, keeping only necessary trading balances in temporary “burner” wallets.
• Cross-check critical announcements across independent channels — When a decentralized application experiences unexpected downtime, interface glitches, or suspicious transaction requests, verify the situation on the project’s official Discord, Telegram announcements, or team developer feeds before signing any transaction.

Elena Kowalski’s take

Relying on traditional web registrars to guard billions in decentralized value remains Web3’s most stubborn structural blind spot. Namecheap’s upcoming forensic report on how staff fell for the social engineering lure is the critical document I want to examine. If registrar-level account takeovers begin bypassing hardware security keys across other major DeFi frontends, my belief that frontend DNS hijacking can be contained by rapid incident response will prove obsolete.

The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.