Across Protocol said on November 11 that it had regained control of its website after attackers redirected visitors to a phishing page during a domain takeover the previous day. The Across Protocol domain hijack put users who connected wallets or signed transactions during the incident at risk, even though the organization has not reported a compromise of its underlying bridge contracts.
In its recovery announcement, Across said its systems were operational again and pledged to compensate affected users. The protocol has not yet provided a final audited tally of losses or victims. The incident is distinct from a smart-contract exploit: the apparent entry point was control of the web address used to access the bridge.
How the Across Website Was Redirected Toward Phishing
According to Across’s incident disclosure, an attacker gained control of its domain at approximately 18:45 UTC on November 10 through what the team described as social engineering involving registrar Namecheap. Across reported receiving an alert within 15 minutes and moving to disable the website. The SEAL911 security response network helped flag the address in wallets, while Cloudflare subsequently removed the affected DNS records.
That distinction matters because people could type the genuine domain and still reach an attacker-controlled page. A familiar bookmark or correct spelling does not guarantee that the website behind the address remains trustworthy after registrar-account compromise.
Why Wallet Approvals Remain Relevant After Domain Recovery
A recovered website does not automatically cancel token permissions that a visitor granted to a malicious contract during the attack window. According to GoPlus Security’s incident alert, the phishing operation solicited approvals and permit signatures. The firm estimated losses of roughly $350,000 across several networks, but that figure remains a third-party estimate rather than a confirmed final figure from Across.
People who signed approvals on November 10 should independently check their transaction and authorization histories. Revoke.cash explains that revoking an allowance can prevent further transfers under that allowance, although it cannot reverse funds already transferred. Users can also consult BlockBriefing’s guide to crypto token approvals for the underlying security concepts.
What Is Known About Losses and User Reimbursement
The Across Protocol domain hijack has prompted a reimbursement commitment, but the team has not published an independently reconciled list of affected wallets or transaction amounts. For now, the reported loss estimate should be identified with its source rather than presented as a confirmed settlement figure. Across has said it intends to publish a full post-mortem explaining the incident.
Victims should beware of impersonators offering compensation through private messages. Wallet recovery should begin with independently verified project communications, not unfamiliar links supplied by unsolicited accounts.
Across Says Its Core Bridge Was Not Compromised
Across stated that its API and third-party integrations were not affected by the domain takeover, distinguishing the website-level incident from direct compromise of bridge infrastructure. Its restoration announcement reflects the state of operations as reported by the project, not an independent security audit.
The next material development will be the promised incident report: it should clarify how registrar access was obtained, the duration of malicious redirection, how many users were affected and how compensation claims will be verified. Until those questions are answered, the Across Protocol domain hijack remains an important example of how off-chain infrastructure can expose on-chain wallets.
