Aave user loses $305,000 after Across Protocol website hijack

Bitquery's revised trace estimates $401,900 taken from nine wallets across five blockchains, using prices at the time the assets were stolen, and the Aave depositor accounts for about 76% of the traced losses. The update adds a previously missed ether sweep.

Across Protocol said its domain was taken over on Nov. 10 through social engineering involving its registrar, Namecheap. The protocol pledged to reimburse affected users after reporting its domain was restored.

How the Aave deposit token moved

The asset taken from the largest wallet was aWETH, an interest-bearing token representing an Aave deposit. Aave's documentation explains that its deposit tokens can be transferred and that a signed permit can authorize another account to spend them.

In Bitquery's reconstruction, the fake site requested a permit, which the attacker then used to move the depositor's tokens, and that spending permission put the separate lending position within reach. The first transfer transaction on Nov. 10 recorded an unlimited approval followed by about 115.23 aWETH sent to one wallet and 28.81 aWETH to another.

Transaction details

Bitquery identifies the recipients as the attacker's wallet and the drainer's fee wallet, respectively, matching an 80/20 split. The depositor's transfer history shows four pulls ending three minutes after the first.

Bitquery says the owner revoked the approval a minute after the last pull, but the transfers had already happened by that point. The Nov. 12 addition was a separate 26.38 ETH sweep from another victim, valued by Bitquery at about $54,000 at the time.

On Nov. 11, Across Protocol said the domain was back under its control and pledged to make affected users whole and publish a postmortem. Bitquery ties the drains to Across through timing and recipient wallets, while acknowledging that blockchain records cannot show which website a victim visited.