Across Protocol has restored its website after hackers took control of its domain on November 10 and redirected visitors to a phishing page. The cross-chain bridge confirmed on November 11 that its systems were working normally and promised to compensate affected users.
Security firm GoPlus estimated that attackers stole nearly USD 350,000 across six blockchain networks. However, Across has not confirmed the total losses or disclosed how many users were affected.
Across confirmed that attackers gained control of its official domain, across.to, at approximately 18:45 UTC on November 10. The team attributed the breach to a social engineering attack targeting domain registrar Namecheap.
The attackers changed the domain settings and redirected visitors to a fraudulent website. The page appeared to offer the bridge's normal services but instead attempted to obtain access to users' cryptocurrency wallets.
Across said it received an alert within 15 minutes and immediately began efforts to disable the compromised website. Security response group SEAL911 helped major wallet providers identify the domain as a phishing site.
Cloudflare also flagged the website as dangerous before removing its DNS records. The team temporarily suspended its website and API services while working to secure the domain.
On Wednesday, Across announced that it had regained control with assistance from Namecheap founder Richard Kirkendall. It also thanked him for helping secure its account and opening an investigation into the incident.
"All affected users will be made whole. We'll share a full post-mortem in the coming days," the team stated.
GoPlus reported that the phishing attack affected wallets across Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma. The security firm estimated total losses at approximately USD 350,000.
The attackers reportedly used fraudulent token approvals and wallet signatures to gain permission to transfer cryptocurrencies. Some users may also have sent funds directly to addresses controlled by the attackers.
Separately, blockchain analytics firm Bitquery traced approximately USD 348,000 in losses from nine wallets across five networks. Its investigation found that one wallet accounted for about USD 305,000 of the stolen funds. However, the figures remain estimates from independent security researchers. Across has not released its own verified breakdown of the losses.
The protocol said users who accessed its website before the takeover were unaffected. It also confirmed that third-party integrations and users accessing its bridge through APIs were not affected by the domain compromise.
Following the recovery, Across directed users who connected their wallets during the attack to review their permissions. The team recommended using Revoke.cash to remove suspicious approvals granted on November 10.
These approvals can allow unauthorized transfers even after the phishing website goes offline. However, removing an approval cannot reverse funds already transferred to an attacker.
Across Protocol also urged affected users to report suspicious transactions through its official communication channels. It warned against unsolicited messages from accounts impersonating its representatives.
The protocol said some browser and wallet security warnings might remain visible temporarily, despite the website's restoration. Across Protocol has not announced a compensation payment schedule. Its investigation remains ongoing, with a detailed report expected to explain how attackers gained control of the domain.
Also Read: Deutsche Bank Launches Digital Asset Custody Service for Crypto Clients