Crosschain interoperability protocol Across regained control of its official domain on Wednesday, resuming normal operations after a takeover that redirected visitors to a phishing site. The incident began at 18:45 UTC on Nov. 10 when attackers executed a social engineering attack against Namecheap, the protocol’s domain registrar. Across received an alert within 15 minutes and immediately began efforts to take the compromised site offline. Security response group SEAL911 flagged the domain as a phishing threat with major wallet providers, while Cloudflare marked it at risk and removed its DNS records. This action rendered the malicious page inaccessible to users attempting to access the legitimate service.
Financial Impact and Recovery Measures
Security platform GoPlus estimated total user losses at $350,000, with funds stolen from wallets on Ethereum, Arbitrum, Base, BNB Chain, Ink, and Plasma. The phishing page lured victims into signing fake token approvals or permits designed to drain their assets. Across did not disclose the specific number of impacted users but announced that all affected parties would be made whole. The protocol confirmed that it restored all systems to normal operations with assistance from Namecheap later in the day.
| Network | Status |
|---|---|
| Ethereum | Funds Stolen |
| Arbitrum | Funds Stolen |
| Base | Funds Stolen |
| BNB Chain | Funds Stolen |
| Ink | Funds Stolen |
| Plasma | Funds Stolen |
The rapid containment by Cloudflare prevented further damage, yet the initial breach exposed significant vulnerabilities in third-party registrar security. I view the full reimbursement promise as a critical trust signal for users who lost funds during this window. These incidents follow a surge in security breaches accelerated by AI tools that enable faster attacks. DefiLlama data shows $8.78 billion has been lost across 341 crypto hacks and exploits year-to-date, led by a $6.36 billion breach at Binance. Separately, decentralized exchange Arcus reported losing around $2.23 million in USDG stablecoins due to an accounting bug on Tuesday. An exploiter attempted another $3 million in withdrawals, which bridge rate limits prevented. Arcus stated no other user accounts were impacted and covered the shortfall with company treasury funds. Suiball, a Sui-native hardware wallet project, also announced closure on Tuesday because the Sui Foundation deemed backing it too risky amid recent attacks on crypto hardware wallets.
