Across Bridge hack: hijacked domain, $350,000 lost

The Across Bridge did not fail because of its smart contracts but because of its web address. On the evening of Tuesday, November 10, attackers took over the across.to domain and redirected visitors to a convincing phishing page. Anyone who connected a wallet there and confirmed an approval or signature should check and revoke their token approvals now. Across has since regained the domain and promises full compensation to everyone affected.

Security firm GoPlus estimates the damage at around $350,000, spread across six blockchains. Across itself has so far given neither its own figure nor the number of people affected. For crypto investors, one point matters most: the target of the attack was users’ wallets, while the protocol itself stayed intact. Only those who signed on the fake page during the hijack window lost money. Anyone moving coins between networks through a regulated crypto exchange was not exposed to this attack path, because the exchange handles the network switch internally and requires no approval from your own wallet.

Across Bridge: what happened on November 10

Across is a bridge, a protocol that moves tokens between blockchains, for example from Ethereum to Arbitrum or Base. Users typically open the web interface at across.to, connect their wallet and confirm the transfer. It was precisely this web interface that the attackers took over.