Across says its official website domain was taken over in a social engineering attack against Namecheap; frontend and API are suspended and affected users will be compensated
Cross-chain protocol Across disclosed that at about 02:45 Beijing time (about 18:45 UTC), attackers gained control of Across’s official website domain (across.to) through a social engineering attack targeting domain registrar Namecheap. Across said it received alerts about 15 minutes after the incident and began taking the website offline.
SEAL911 helped major wallets mark the domain as a phishing website, and Cloudflare subsequently removed its DNS records. As of the time Across announced this, the phishing page was no longer accessible.
Across said some users who visited the official website before the phishing page was fully blocked may have been affected. Users who visited the official website before the attack, as well as users who used the protocol through the API or third-party integrations, were not affected by this attack. Across promised to fully compensate affected users and advised the relevant users to use the wallet they had connected at the time to revoke the permissions granted that day on Revoke.cash.
Across said it had not yet received a response from Namecheap at that time, and the frontend and API would remain suspended until domain security was confirmed. The team will investigate why the domain was taken over and will publish a postmortem of the incident after obtaining more information.
Original sources:
Title: Across official incident disclosure (cited in X posts and related reports) Publisher: Across Protocol (official cross-chain protocol) Publication date: 2026-11-10/11 URL: https://x.com/AcrossProtocol（相关帖子；具体帖子 (ID subject to the latest official version) Source nature: official protocol announcement/disclosure Verification status: this translation cross-checked the official disclosure through multiple media reports, verification date 2026-11-11; no access restrictions Supporting content: supports the core facts of the domain takeover time, description of the Namecheap social engineering attack, response within 15 minutes, SEAL911 and Cloudflare intervention, scope of affected users, compensation commitment, and suspension of the frontend/API, among others
ABAB AI Insight
This incident is a social engineering attack at the domain registrar level, rather than a vulnerability in the smart contract or bridge protocol itself. After taking over the domain, the attacker could deploy a phishing page to induce users to sign approvals or transactions, thereby causing asset losses at the wallet level.
Across responded quickly and used SEAL911 and Cloudflare to block the phishing page, narrowing the exposure window. The protocol clearly distinguished between front-end visitors who may have been affected and API/third-party users who were not affected, and promised full compensation, which helps reduce users’ expected risk.
Security at the domain and DNS layers depends on the registrar’s response speed and account protection measures. Even if the protocol contracts themselves are not affected, takeover of the front-end domain can still directly harm users. The subsequent Namecheap investigation results and the complete postmortem released by Across will further clarify the attack path.
ABAB News · Cognitive Law
The domain takeover is stated by Across itself; independent confirmation on the Namecheap side and the full technical path still await later disclosure.
“Full compensation” is a protocol commitment; the number of affected users and the amount of losses are not publicly disclosed at present.
Taking the frontend offline and blocking the phishing page does not mean all signed approvals are automatically invalidated; users still need to actively revoke the relevant permissions.