Overview
- Attackers gained control of the across.to domain through a social‑engineering attack on registrar Namecheap, replacing the site with a phishing page that targeted users' wallet permissions on Tuesday evening.
- Security firm GoPlus estimated roughly $350,000 was drained from wallets across Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma, while Across has not published a confirmed loss total.
- Across shut down its compromised frontend, worked with SEAL911 and Cloudflare to flag and block the phishing domain, and regained control of the domain with assistance from Namecheap’s founder.
- The protocol said APIs and third‑party integrations were unaffected, asked affected users to revoke approvals and submit transaction details, and pledged to make victims whole and publish a full post‑mortem.
- The attack underscores a wider shift in threat actors toward registrar and DNS‑level hijacks that abuse off‑chain permit signatures, a trend that could force bridges to tighten domain and registrar controls.