A sophisticated social engineering attack against domain registrar Namecheap allowed hackers to briefly hijack the official website of cross-chain bridge Across Protocol, tricking connected crypto wallets into signing malicious permissions that siphoned approximately 350,000 USD before defenders neutralized the threat.
By Priya Sharma | November 12, 2026
The Incident: DNS Hijack Targets Across Protocol Domain
On November 10, 2026, at approximately 18:45 UTC, security monitors detected unauthorized changes to the domain routing records of across.to, the web interface for the popular decentralized bridge Across Protocol. Attackers gained access not by breaking cryptographic algorithms or finding flaws in blockchain software, but by using deceptive social engineering techniques against the customer support staff at Namecheap, the domain registrar managing the protocol’s web address.
Once inside the registrar account, the perpetrators redirected web traffic away from the legitimate application servers and pointed visitors to an identical, counterfeit website. To everyday users visiting the site, the screen appeared entirely normal. However, behind the familiar visual interface lurked malicious scripts programmed to solicit wallet signatures that granted the attacker direct access to transfer deposited tokens.
The protocol’s engineering team, working in emergency coordination with white-hat security coalition SEAL911, moved rapidly to contain the incident within 15 minutes of public alerts. Security partners alerted major crypto wallet extensions to flag the domain as dangerous, while web infrastructure provider Cloudflare intervened to mark the destination as high risk and pull the rogue routing entries. By early November 11, Across confirmed that it had regained total administrative control of the domain name and restored legitimate routing for all visitors.
- Total estimated losses — Approximately 350,000 USD in digital tokens taken from users who interacted with the fake interface.
- Attack vector — Social engineering breach at Web2 domain registrar Namecheap, redirecting DNS records.
- Smart contract status — 100 percent intact; on-chain bridge vaults and liquidity pools were never accessed or compromised.
- Response window — Threat identified and emergency countermeasures deployed within 15 minutes.
- User compensation — Protocol leadership has committed that all verified victims will be reimbursed in full.
Technical Post-Mortem: How Frontend Phishing Bypassed Smart Contracts
For everyday investors, understanding this attack requires separating the blockchain from the website you use to interact with it. Think of a decentralized finance protocol as a secure bank vault built in the middle of a public park, and think of the website as the marked pathway leading to the vault’s door. The attackers did not blow open the steel vault door; instead, they moved the signposts in the park to lead unsuspecting pedestrians into an alley where a pickpocket stood waiting.
I checked the on-chain contract addresses against the protocol’s verified deployments: the underlying vault code remained entirely untouched throughout the attack. The actual vulnerability existed entirely within the legacy internet domain routing system, commonly known as Domain Name System (DNS).
When users connected their wallets to the fraudulent frontend, the rogue software generated signature requests rather than standard bridge deposit instructions. Specifically, the attackers leveraged advanced token authorization methods known as EIP-2612 permits and Uniswap’s Permit2 protocol. In simple terms, these mechanisms function like signing a blank check: by signing a gasless digital signature on your screen, you grant an external smart contract permission to pull a specific amount of tokens from your wallet at any time.
According to blockchain forensic data from security analytics firms GoPlus Security and Bitquery, the drainer contracts swept funds across multiple blockchain ecosystems, including Ethereum, Arbitrum, Base, BNB Chain, Ink, and Plasma. Because the malicious authorizations remain active on the blockchain until manually cancelled, anyone who connected their wallet to the service during the incident window must visit revocation portals such as Revoke.cash to terminate open permissions immediately.
Governance Impact: Restitution Pledges and Registrar Hardening
The swift operational response from Across Protocol helped prevent a catastrophic drain, but the incident has sparked urgent governance debates surrounding how decentralized organizations manage traditional internet assets. Across leadership issued an unambiguous public pledge stating that every victim who suffered losses as a direct result of the domain hijack will receive complete restitution.
Promising full compensation protects community morale and defends the protocol’s market standing, yet it also highlights an operational paradox across the decentralized finance sector. Protocol developer teams routinely spend hundreds of thousands of dollars on rigorous, multi-firm cryptographic audits to verify that mathematical algorithms contain zero flaws. However, those mathematically immaculate contracts remain tethered to Web2 administrative portals that rely on human customer service agents susceptible to phone calls, forged identity documents, and phishing.
Within DAO governance forums, community members are now pushing for strict operational standards. These proposals include requiring multi-party hardware security keys for all registrar accounts, establishing registry locks that prevent domain modification without certified written notices, and exploring censorship-resistant frontend hosting alternatives such as the InterPlanetary File System (IPFS) and Ethereum Name Service (ENS) domains.
TVL Shifts: Bridge Liquidity Holds Steady Under Pressure
Unlike smart contract exploits that drain shared lending pools or empty liquidity reservoirs, this frontend breach left the protocol’s underlying capital reserves completely intact. Liquidity providers who deposit funds into Across pools to earn transaction yields saw zero loss of principal, as the attacker could only siphon tokens from retail wallets that mistakenly granted direct approval signatures.
Consequently, Total Value Locked (TVL) across Across Protocol avoided the violent liquidations and bank-run dynamics that often follow smart contract collapses. Automated arbitrage relayers and algorithmic market makers—which interact directly with blockchain nodes via automated application programming interfaces (APIs) rather than browsing web pages—continued executing rebalancing operations with minimal friction.
Nonetheless, general market sentiment remains subdued. Broader cryptocurrency markets are navigating cautious waters, with Bitcoin trading near 71,849 USD and Ethereum hovering at 2,015 USD, while the Crypto Fear & Greed Index stands at a reading of 28, indicating lingering “Fear.” While retail bridge transfer volumes temporarily plunged as cautious traders waited for official all-clear announcements, core liquidity deposits remained sticky once investors recognized that the protocol’s smart contracts had not suffered a fundamental economic breakdown.
Long-Term Prognosis: Web2 Infrastructure Remains DeFi’s Weakest Link
The Across domain hijacking delivers a vital lesson for individual investors navigating decentralized finance: an unhackable smart contract cannot protect you if the graphical interface in your web browser has been compromised. As automated on-chain security continues to mature, malicious actors are increasingly turning their attention toward supply chain chokepoints in traditional web hosting, content delivery networks, and domain registrars.
For everyday token holders, protecting capital requires adopting systematic self-defense habits rather than relying solely on visual website branding:
- Audit approval requests carefully — Never click “Confirm” on wallet pop-ups that request broad asset transfer permissions or unverified off-chain permits when performing simple swap or bridge actions.
- Install transaction simulators — Modern security extensions simulate the financial outcome of an interaction before you sign, warning you if an approval will permit a third party to sweep your balance.
- Regularly revoke approvals — Set a recurring monthly calendar reminder to review open permissions on security tools like Revoke.cash and sever authorization lines to platforms you are not actively using.
- Use secondary burner wallets — Avoid connecting primary storage vaults to web browsers. Transfer only the exact sum needed for a transaction into an intermediary wallet before bridging.
Across Protocol’s prompt containment and pledge of comprehensive reimbursement have set an exemplary standard for crisis response. However, until decentralized finance fully decouples user interfaces from vulnerable centralized web hosting providers, frontend hijacking will remain one of the most perilous traps awaiting unsuspecting crypto investors.
Priya Sharma’s take
In my assessment, guaranteeing on-chain code while leaving domain registrars exposed to phone-based social engineering turns decentralized security into security theater. Scrutinizing the post-mortem disclosures will show whether Across migrates its frontend routing to decentralized nameservers or sticks with legacy domain management. Any discovery that compromised API endpoints went undetected during the 15-minute hijack window would lead me to regard this breach as a deeper systemic failure rather than a superficial domain slip.
The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.
namecheap support got socially engineered and across users paid the price. 350k gone from what was basically a DNS swap, scariest part is the site looked completely normal
^ exactly. revoke approvals after every bridge session, takes 30 seconds on revoke.cash and would have saved a few wallets here
The weak link was never the bridge contract, it was the registrar. Hope the restitution actually lands quick and they name whoever approved the DNS change