Across Protocol restores website after hackers hijack domain
Cross-chain bridge Across Protocol has regained control of its website after a social engineering attack allowed hackers to hijack its domain and replace it with a phishing site.
Cross-chain bridge Across Protocol said it has regained control of its website after a social engineering attack on Tuesday enabled attackers to gain control of its domain, replacing its website with a phishing site. In a post on Wednesday, Across said the across.to domain is back under their control with help from Namecheap founder Richard Kirkendall, and that all systems are now working normally.
All affected users will be made whole. We'll share a full post-mortem in the coming days.
Attack Details
Across attributes the takeover to a social engineering attack on its domain registrar, Namecheap, which gave an attacker control of its domain at approximately 18:45 UTC on Tuesday. The team said it was alerted within 15 minutes and immediately worked to shut the website down.
Security response group SEAL911 helped flag the domain as phishing with major wallets, while Cloudflare marked it as at risk and later removed its DNS records. Some users who visited the domain before the malicious site was fully blocked may have been affected, though third-party integrations and API users were unaffected.
Impact Assessment
The incident affected one of the largest cross-chain bridges by trading activity. Across ranked third by 30-day transfer volume, behind Circle and LayerZero, according to DefiLlama, having processed about $5.9 billion over the period. The total losses and number of affected users have not yet been disclosed.
The update follows Across's Tuesday warning to users to avoid its app amid reports of drained wallets. The team has promised to compensate all affected users while conducting a thorough investigation into the security breach.
Related
