Across Protocol restores website after domain hijack

Across Protocol said it has regained control of its website after attackers hijacked its domain and replaced the legitimate interface with a phishing page. The cross-chain bridge said its systems were operating normally again and promised to compensate users affected by the incident.

The recovery followed a warning to avoid the app amid reports of drained cryptocurrency wallets, according to Cointelegraph. Across attributed the takeover to a social engineering attack targeting its domain registrar, Namecheap, rather than describing it as an exploit of the bridge’s underlying contracts.

According to the team’s account, an attacker gained control of the domain at approximately 18:45 UTC on Tuesday. Across said it learned of the attack within 15 minutes and immediately began working to shut down the compromised website, while outside responders helped limit access to the fraudulent page.

Security response group SEAL911 helped get the domain flagged as phishing by major cryptocurrency wallets. Cloudflare also marked the domain as at risk and subsequently removed its DNS records, according to Across’s account reported by Cointelegraph. Those actions were intended to prevent further visitors from reaching the attacker-controlled site while recovery efforts continued.

In its Wednesday restoration announcement, Across credited Namecheap founder Richard Kirkendall with helping secure its account and opening an investigation, according to reporting by crypto.news. The announcement marked a change from the team’s earlier account, when it said it had not received a response from the registrar and was keeping services suspended pending security checks.

The distinction between a website takeover and a contract exploit matters for understanding the exposure. In this case, the reported attack placed a malicious interface behind a familiar web address, creating a route for visitors to authorize harmful wallet actions. Across said users accessing the protocol through third-party integrations or its API were unaffected.

Restoring the domain does not, by itself, resolve every consequence for people who interacted with the phishing page. Reporting by Coindaro, citing Across’s recovery guidance, said malicious token approvals could remain active after the website was recovered. That makes the handling of wallet permissions a separate part of the response from restoring normal website operations.

The financial impact remains unsettled. Crypto.news reported that security firm GoPlus estimated losses of about $350,000 across six blockchain networks, but that figure was not a confirmed total from Across. The protocol had not disclosed its own loss assessment or a count of affected users in the restoration update.

Across said it would make affected users whole and release a detailed post-mortem in the coming days. That report is expected to provide the next substantive account of how control was lost, while the compensation pledge remains separate from any demonstrated recovery of stolen funds.