Across takes back across.to after a Namecheap hijack and promises to repay drained users, as Bitquery puts losses near $402,000

Update, 13 November 2026, 17:51 UTC: The analytics firm Bitquery estimates, in an investigation updated on 12 November, that the fake across.to site drained about $402,000 from nine wallets on five chains between 19:02 and 21:53 UTC on 10 November, and it calls the figure a floor. About $304,500 of it came from one Ethereum wallet holding Aave’s aWETH; those transfers can be checked on Etherscan and went to two addresses that Across’s recovery guide lists as receivers of stolen funds. Across itself still gives no loss total, and the post-mortem it promised on 11 November has not been published.

Across Protocol, one of the busiest crypto bridges, lost control of its website domain across.to for several hours on Tuesday 10 November, and visitors were shown a fake app that asked them to sign token approvals. The blockchain to another, usually by locking the assets on the source chain and issuing an equivalent token on the destination chain, or by using liquidity on both sides.">cross-chain bridge says an attacker took the domain at about 18:45 UTC through a social engineering attack on its registrar, Namecheap. By 01:16 UTC on Wednesday 11 November Across said the domain was back under its control and that all its systems were working normally. It has promised that affected users will be made whole, but it has published no loss total and no count of victims. The analytics firm Bitquery estimates the losses at about $402,000 from nine wallets, a figure Across has not confirmed.

Nothing Across has said points to a flaw in its smart contracts. The theft, as Across describes it, happened at the front door: whoever controls a domain decides which website a browser loads, and for a few hours across.to loaded a wallet drainer instead of the bridge.

That makes this Across Protocol hack a different animal from a contract exploit, and the practical consequence is on the user’s side. Anyone who connected a wallet and signed something on across.to on 10 November may still have approvals open to attacker contracts. Across has published a recovery guide that lists those contracts network by network; the addresses are reproduced below.

What happened to across.to on 10 November, hour by hour

The timeline comes from Across’s own posts on X and from reporting by Cointelegraph. All times are UTC.

The first warning was blunt. “Do NOT visit the app, connect your wallet, or sign any transaction or approval there until further notice,” Across wrote, in the text quoted by DeFi Prime. At that point it described a “potential security incident” and did not say the website had been taken, Cointelegraph reported.

The longer account arrived at 22:13 UTC. In it, Across said that within 15 minutes of the takeover it was alerted and moved to shut the site down, that the security group SEAL911 had marked across.to as a phishing site with major wallets, and that Cloudflare worked with the team to flag the domain and later removed its DNS records. “In the brief period before Cloudflare fully blocked the malware site, some users who visited across.(to) may have been affected,” the post says. It adds that no third-party integrations or API users were affected.

How the domain was taken: a registrar, not a contract

The explanation given so far is short: a social engineering attack on Namecheap, its registrar, gave a bad actor control of the domain. It has not said who at Namecheap was approached, through which channel, or what the attacker changed first, whether the account, the nameservers or the DNS records. Those details are what the promised post-mortem will have to answer.

The team was pointed about its own setup. “Across’s domain was fully locked down with best-in-class security practices; this unauthorized takeover should not have been possible,” it wrote at 22:13 UTC. The same post said Namecheap had been unresponsive and that the frontend and API would stay down until the domain could be secured.

A few hours later the tone changed. In its 01:16 UTC post, Across said it was fully restored and thanked the Namecheap founder, under his X handle @synth, for responding, helping secure the account and opening an investigation. Cointelegraph identified him as Richard Kirkendall. Namecheap as a company had published no statement on the case by Friday 13 November, so the only public account of how the takeover happened is still Across’s.

Two outside services did much of the containment. SEAL911, a security emergency response group, got wallets to warn users that across.to was a phishing site. Cloudflare first marked the domain as at risk and then pulled its DNS records, which took the fake app offline while, by Across’s account, Namecheap had still not responded.

Losses: about $402,000 by Bitquery’s count, no total from Across

The only detailed count so far comes from Bitquery, a blockchain analytics firm. In an investigation updated on 12 November, it estimates that the fake site took about $402,000 ($401,900) from nine wallets on five chains, Ethereum, Arbitrum, Base, Optimism and BNB Chain, between 19:02 and 21:53 UTC on 10 November, each theft valued at the time it happened. Its first version, on 11 November, said about $348,000; the increase comes from an ether sweep found later.

One wallet accounts for about three quarters of the total. Its owner held 148.60 aWETH, the token Aave gives to people who deposit ether, worth $304,514 by Bitquery’s count, and had signed a permit on the fake site. The thief pulled the tokens out in four transactions over about three minutes, each split 80/20 between the thief and the drainer’s fee wallet. The owner cancelled the approval a minute after the last pull, too late: the thief had already swapped most of it for ether through UniswapX, Bitquery says. A second Ethereum wallet lost about $55,200, mostly 26.38 ETH, six others lost between about $4,700 and $9,000 each, and one lost only a token with no market price.

That largest theft can be checked on the blockchain. On Etherscan, the first pull, at 20:09:23 UTC on 10 November, moves 115.23 aEthWETH and 28.81 aEthWETH out of the wallet, an 80/20 split, to 0x2846…1fde and 0x0c7c…d37b, two of the four addresses that Across’s recovery guide lists as receivers of stolen funds. Three more pulls followed at 20:12 UTC, for about 148.6 aEthWETH in all. The dollar values, the other eight wallets and the tie between each theft and across.to rest on Bitquery’s analysis.

Bitquery says plainly that the link is circumstantial. Nothing on-chain records which website a victim used, so it ties the drains to across.to through their timing, the 80/20 split and a thief’s wallet that was active only during the hijack. It also calls its total a floor: payouts to the thief through other routes would be missed, chains without transfer data such as HyperEVM and Avalanche are not counted, and tokens with no market price are left out. Plasma and Ink, where Across lists attacker contracts, are not among its five chains, so the 7,053 USDT0 a user reported losing on Plasma is not in the total.

Bitquery also corrects a figure that went round on 11 November. The $294,000 quoted for the hack matched the balance of the drainer’s fee wallet, not the amount stolen. “At least 57% of that balance was there before the hijack,” Bitquery writes, about $167,000 from older thefts, and the figure left out the roughly $278,000 sent straight to the thief.

Across itself has given no loss figure, victim count or list of networks where funds were taken. Before Bitquery’s count, what existed were individual reports. On Tuesday evening Cointelegraph relayed three posts on X: one user said they lost $9,000 in USDC, another reported losing 7,053 USDT0 in seven transactions on the Plasma network, and a third said a wallet was drained after using the bridge several times. Cointelegraph said it had not independently verified any of them. Each is a claim by one user, and they cannot be added up into a total.

The recovery guide gives no amounts either. What it maps is the attacker’s setup: eight spender contracts on six networks (Ethereum, Base, Arbitrum, Ink, Plasma and BNB Chain) and four addresses that received stolen funds. One address sits on both lists, the Plasma contract, and Plasma is the network named in the USDT0 report. According to the guide, the eight contracts run the same malicious code, and the attacker may reuse the addresses on other networks.

For a sense of how many people use the bridge, Across ranked third among bridges by 30-day transfer volume, with about $5.9 billion moved, behind Circle and LayerZero, according to DefiLlama data cited by Cointelegraph on 11 November. That is a measure of traffic, not of exposure: only people who used the website during the hijack window, and signed what it asked, are at risk.

Who is exposed after the Across Protocol hack

The recovery guide is specific. You should follow it if, on 10 November 2026, you visited across.to and did any of four things: connected a wallet, approved a token, signed a message or permit, or sent a transaction. According to the guide, the fake site asked visitors to sign approvals and permits that let attacker contracts move tokens out of their wallets, and some of those approvals are still open.

An open approval does not expire because the website is fixed. Until it is revoked, the attacker can take any more of that token that lands in the wallet later, a salary payment or a transfer from an exchange, for example. That is why revoking matters even for someone who has already lost funds.

People who use Across through another app or a wallet integration are not on that list. Across says integrations and API users were not affected, and the attack hit the website domain only.

If you are new to bridges, our explainer on how a cross-chain bridge works, from messaging to intents covers what Across does behind its interface.

The attacker contracts to revoke, network by network

These are the spender addresses listed in the recovery guide shared after the incident, which DeFi Prime links as Across’s own. If any of them appears as a spender of your tokens, on any network, Across says to revoke it. The team said it may add more addresses.

The guide lists four addresses that received stolen funds: 0x2846e69d3298e99eddf2fd8116e952844da11fde, 0x0c7c656126aa62625fdd8051eb69dc14aee8d37b, 0x3ef438c34ce51a697a24247fe033c4562c94f0fd (the Plasma contract above) and 0xa0e6c7d79b74d1a6d366dd11309b6faafda05ac5. Never send anything to them, and treat any message that asks you to as a scam.

What to do if you signed on across.to on 10 November

The steps in the guide use revoke.cash, a free tool that lists the token approvals of a wallet. Our own six-step routine for revoking token approvals explains the same tools in more depth. In short:

1. Type revoke.cash into the address bar yourself. Do not follow a revoke link sent in a DM, a reply or an email: copies of the site exist.
2. Paste your address into the search bar to look without connecting. You will need to connect the wallet to revoke anything.
3. Start with the network where you used Across, then repeat for Ethereum, Base, Arbitrum, Ink, BNB Chain and every other network where you hold funds.
4. Paste each malicious address from the table into the Search by Spender box. A row that appears is an approval to the attacker. Sorting by Last Updated and checking anything from 10 November also helps.
5. Check Permit2 rows. Some victims signed a Permit2 permit rather than a direct approval, and revoke.cash shows it as a separate row with the real spender and an expiry note.
6. Revoke each match and confirm in your wallet. Every revoke is an onchain transaction, so keep a little ETH on Ethereum, Base, Arbitrum and Ink, or BNB on BNB Chain.
7. Reload and check that the rows are gone or show an allowance of zero, on every network.

A row whose spender is simply Permit2 is the normal approval apps such as Uniswap use. Across notes that revoking it also cuts any attacker allowance on that token, at the cost of approving again next time you use such an app.

What revoking cannot fix

Revoking stops future theft. It does not bring back tokens already taken, and a direct transfer to the attacker, where the fake site asked you to send coins rather than approve them, leaves nothing to revoke.

There is a gap that revoke.cash cannot show. A permit that you signed but the attacker has not yet submitted onchain exists only as a signature, so it does not appear in any list. Across’s advice for anyone who signed anything on across.to that day is to revoke what is visible and then move the remaining assets to a new wallet. If you cannot revoke straight away, moving the affected tokens out also works, because an approval can only drain what is in the wallet.

Claiming compensation, and the fake support that will follow

Users who lost funds are asked to send Across their wallet address and transaction hashes, and the contact must start from them: Across says it will never send the first DM, ask for a seed phrase or private key, or ask anyone to “validate” or “sync” a wallet on a website. Fake support accounts often follow incidents like this one, so a message offering a refund is more likely to be the second attack than the compensation.

No date, claim form or funding source for the repayment has been announced. Across’s promise, as quoted by Cointelegraph, is short: “All affected users will be made whole. We’ll share a full post-mortem in the coming days.”

How to spot a hijacked front end before you sign

A domain hijack defeats the usual advice to check the URL, because the URL is the real one. What changes is what the site asks you to sign. A few habits make a fake front end easier to catch:

• Read every signature request. A bridge transfer needs an approval for the token you are moving, not an unlimited approval for other tokens or a permit on assets you did not select.
• Compare the spender address in your wallet’s prompt with the contract addresses the project publishes in its documentation. An unknown spender is a reason to stop.
• Take wallet warnings seriously. In this case SEAL911 got major wallets to flag across.to as phishing, and that warning was the first line of defence.
• After a scare, check the project’s official account before going back to its site, and refuse any signature that has no obvious link to the action you wanted.
• Use a separate wallet holding only what you plan to move when you use bridges and new apps, so that an approval can only reach a small balance.

None of this helps against a signature that looks normal, which is why revoking unused approvals every few weeks is part of a basic DeFi security routine.

Second registrar hijack of DeFi sites in 12 days

The Across case lands less than two weeks after a wave of DNS hijacks on DeFi websites registered with Name.com on 30 and 31 October. Our report on the Name.com DNS hijack covers that episode, whose cause was still unconfirmed at the time.

Namecheap itself has been here before. Around 23 June 2022, attackers hijacked the DNS records of DeFi projects using it, among them Convex Finance, Ribbon Finance, Allbridge and DeFi Saver, and pushed visitors to approve malicious contracts. Kirkendall, Namecheap’s chief executive at the time, said that the company had traced the problem to “a specific CS agent that was either hacked or compromised somehow” and removed that agent’s access, ForkLog reported on 24 June 2022.

In July 2024, Compound Finance, Celer Network, Pendle Finance and Unstoppable Domains had their domains taken after Google Domains customers were moved to Squarespace; researchers blamed weak account defaults, a reading Squarespace later contested in its own post-mortem, Krebs on Security reported on 15 July 2024. Galxe in October 2023 and Aerodrome and Velodrome in November 2025 lost their front ends in similar ways, as The Block recalled in its coverage of the Name.com wave.

For Across, this is the second incident in four months but of another kind. On 17 July 2026 a relayer operated by Risk Labs advanced about $4.5 million against 581 fake Solana deposit requests, for a net loss of under $4 million; Across blamed off-chain software and said user funds were unaffected, crypto.news reported. The 10 November attack did not touch the protocol’s machinery. It went through the registrar.

What is still unknown

The list of open questions is long, and most of them will only be answered by the post-mortem Across promised on 11 November “in the coming days”, still unpublished on 13 November:

• Across’s own count of losses and victims. Bitquery’s estimate of about $402,000 is a floor that leaves out some chains, and Across has neither confirmed nor disputed it.
• How the social engineering worked at Namecheap, and what Namecheap’s own investigation finds. The registrar has not published its account.
• Whether any stolen funds have been frozen or recovered, for instance stablecoins whose issuers can block addresses.
• Who pays the compensation, how claims will be checked, and when payments start.

Until those answers arrive, the useful step is the one Across asked for on Tuesday night: anyone who touched across.to on 10 November should check every network for the spender addresses above and revoke what they find.