Across takes frontend and API offline after domain takeover

The incident began at approximately 18:45 UTC on November 10, 2026, when Across detected that an attacker had taken control of its domain through a social engineering attack on Namecheap, its domain registrar.

The attacker used this control to create a phishing site that mimicked the legitimate Across frontend. Across immediately took its frontend and API offline to prevent further damage and began working to secure the domain.

Across was alerted to the takeover within 15 minutes and acted swiftly to shut down the site. Cloudflare and SEAL911 subsequently marked the domain as at risk and pulled its DNS records, making the phishing site unavailable.

The attack allowed the malicious site to request token approvals and permits from visitors. These permissions could allow the attacker-controlled contracts to move tokens from users' wallets even after the site itself was removed.

Across’s initial warning told users: “Do NOT visit the app, connect your wallet, or sign any transaction or approval there until further notice.” The protocol later clarified that earlier frontend users, API users, and users of third-party integrations were unaffected.

Recovery guide and reimbursement

Across has provided a detailed recovery guide for users who visited the site on November 10 and connected their wallets. The guide instructs users to check for and revoke permissions on all networks where they hold funds.

Users are advised to visit revoke.cash themselves and avoid revocation links received in direct messages or emails, as scammers may have copied the site. The guide covers wallets with no visible loss as well as those that have already lost funds.

The guide warns that approvals granted on the malicious site remain open and can be exploited. It states: “Until you revoke them, the attacker can take any more of those tokens that arrive in your wallet.”

Across has promised to reimburse all affected users, stating: “All affected users will be made whole.” The protocol has asked affected users to contact it via direct message to begin the reimbursement process.

Users are instructed to begin with the network where they used the frontend and then inspect Ethereum, Base, Arbitrum, Ink, BNB Chain, and any other network where they hold funds. Each matching revocation must be confirmed as an on-chain transaction.

The guide also addresses the unique risks of signed permits. A permit that the attacker has not yet submitted will not appear on revoke.cash, but it can still leave the wallet exposed. Revoking the token approval to the Permit2 contract cuts off this allowance.

For users who cannot revoke permissions immediately, the guide recommends moving affected tokens out of the wallet, as an open approval can drain tokens held there. Revoking a permission prevents future theft but does not recover assets already taken.

Across has committed to publishing a postmortem explaining how the takeover happened. The disclosure gives no restoration deadline and states that the team will keep both the frontend and API down until it can secure them sufficiently to restore service.