Across Protocol restores website after hackers hijack domain

Cross-chain bridge Across Protocol said it has regained control of its website after a social engineering attack on Tuesday enabled attackers to gain control of its domain, replacing its website with a phishing site. 

In a post on Wednesday, Across said the across.to domain is back under their control with help from Namecheap founder Richard Kirkendall, and that all systems are now working normally. 

“All affected users will be made whole. We’ll share a full post-mortem in the coming days,” the team said on X. 

The update follows Across’s Tuesday warning to users to avoid its app amid reports of drained wallets. The total losses and number of affected users have not yet been disclosed. 

Across attributes takeover to social engineering

In an earlier update, Across said a social engineering attack on its domain registrar, Namecheap, gave an attacker control of its domain at approximately 18:45 UTC.

The team said it was alerted within 15 minutes and immediately worked to shut the website down. Security response group SEAL911 helped flag the domain as phishing with major wallets, while Cloudflare marked it as at risk and later removed its DNS records.

Some users who visited the domain before the malicious site was fully blocked may have been affected, the team said. Third-party integrations and API users were unaffected.

The incident affected one of the largest cross-chain bridges by trading activity. Across ranked third by 30-day transfer volume, behind Circle and LayerZero, according to DefiLlama, having processed about $5.9 billion over the period. 

Related: Across Protocol warns users to avoid app amid reports of drained wallets