Across Bridge hack: hijacked domain drains around $350,000 from wallets on six blockchains

The Across Bridge did not fail because of its smart contracts but because of its web address. On the evening of Tuesday, November 10, attackers took over the across.to domain and redirected visitors to a convincing phishing page. Anyone who connected a wallet there and confirmed an approval or signature should check and revoke their token approvals now. Across has since regained the domain and promises full compensation to everyone affected.

Security firm GoPlus estimates the damage at around $350,000, spread across six blockchains. Across itself has so far given neither its own figure nor the number of people affected. For crypto investors, one point matters most: the target of the attack was users’ wallets, while the protocol itself stayed intact. Only those who signed on the fake page during the hijack window lost money. Anyone moving coins between networks through a regulated crypto exchange was not exposed to this attack path, because the exchange handles the network switch internally and requires no approval from your own wallet.

Across Bridge: what happened on November 10

Across is a bridge, a protocol that moves tokens between blockchains, for example from Ethereum to Arbitrum or Base. Users typically open the web interface at across.to, connect their wallet and confirm the transfer. It was precisely this web interface that the attackers took over.

According to Across, the attack began early on Tuesday evening. That same evening the team warned on X that no one should open the app, connect a wallet or sign transactions and approvals. By then several users were already reporting emptied wallets. According to Cointelegraph, one user reported a loss of 9,000 USDC and another 7,053 USDT0, drained in seven transactions on the Plasma blockchain. These individual figures come from the victims themselves and have not been independently confirmed.

On Wednesday morning, November 11, Across gave the all-clear: the domain was back under its control and all systems were running normally. The team thanked Namecheap founder Richard Kirkendall, who had responded on X, helped secure the account and opened an investigation.

Domain hijacking via the registrar Namecheap

Domain hijacking is the takeover of a web address by unauthorised parties. Whoever controls a domain decides, through its DNS records, which server it points to. DNS is the address book of the internet: it translates a name such as across.to into a server address. If an attacker changes this record, visitors land on the attacker’s server even though the browser’s address bar shows the correct domain.

Across blames a social engineering attack on the registrar Namecheap. A registrar is the company with which a domain is registered and managed. In social engineering, attackers trick people rather than technology: they pose as the account holder, for instance, and get support staff to change credentials or transfer an account. Exactly how this played out in the Across case is unclear. The team says the domain was protected by the usual security measures and has promised the details in its final report. According to the available reports, Namecheap has not yet commented publicly on what happened; so far the cause rests solely on Across’s account.

The speed of the response stands out. According to crypto.news, Across received a warning within 15 minutes. Security group SEAL 911 had across.to flagged as a phishing site with major wallet providers, Cloudflare classified the domain as dangerous and removed the DNS records. Across temporarily shut down its web interface and API until the domain had been recovered.

Around $350,000 in losses on six blockchains

GoPlus puts the losses at just under $350,000. According to this estimate, wallets on Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma were affected. Another figure of around $294,000 is circulating in some media, with no traceable origin. Until Across presents its own numbers in the final report, the scale should therefore be read as a range: a few hundred thousand dollars, spread across a still unknown number of wallets.

Compared with major bridge hacks such as the 2022 attack on the Ronin bridge, in which more than $600 million flowed out of the contracts themselves, the sum is small. For the individual victims that changes little, because a drainer usually empties a wallet completely, as far as the granted approvals reach. The individual cases reported involve stablecoins such as USDC and USDT0.

Approvals, permits and Permit2: the signatures the drainer used

A wallet drainer is a program on a phishing site that tricks users into giving it access to their tokens. According to GoPlus’s analysis, the fake Across page used three methods that are typical of such attacks:

• Direct token approval: an on-chain transaction that allows a third-party address to move tokens of a particular type out of the wallet. This approval costs fees and shows up in the block explorer.
• EIP-2612 permit: a signature given off-chain that grants the same permission. The signature costs nothing and initially appears nowhere. Only when the attacker submits it does it become an approval.
• Permit2 authorisation: Permit2 is a widely used contract through which many applications bundle approvals. Anyone who has approved it once can grant individual addresses access with a further signature.

In some cases, according to GoPlus, victims were also tricked into sending coins directly to the attackers’ addresses. What all these methods have in common is that wallet software only shows what is being signed, not whether the page is genuine. On a hijacked domain everything looks as usual. How such signatures work in principle and how to recognise them in the confirmation window is explained in our guide to wallet drainers and approvals.

Smart contracts untouched: why the bridge itself stayed safe

Across stresses that the protocol’s smart contracts were not affected. Funds in the bridge contracts and providers’ liquidity were left untouched. Users of the API and third-party applications that integrate Across in the background were also unaffected, according to the team. Anyone who bridged through a wallet app or an aggregator that merely uses Across as a route never saw the fake page.

The distinction matters for the question of whether balances in bridge transfers are at risk. A transfer started through the genuine site before the attack ran through the unchanged contracts. The danger lay only in a combination of three conditions: visiting across.to during the window, a connected wallet and a confirmed signature or transaction.

Revoking token approvals: how to check your wallet

If you visited across.to on November 10 or 11, check your wallet’s approvals immediately. It takes a few minutes:

1. Show approvals: Enter your wallet address on Revoke.cash or in Etherscan’s Token Approval Checker. Revoke.cash shows approvals across many networks, including Permit2 approvals. Arbitrum and BNB Chain have their own explorers with the same function.
2. Look for suspicious entries: Watch for approvals dated November 10 or 11, unknown recipient addresses and “unlimited” amounts. GoPlus has flagged several recipient addresses from the attack as suspicious.
3. Revoke: Each revocation is a small transaction of its own that incurs fees on the network concerned. On Ethereum, a revocation recently cost only fractions of a cent, as our September article on revoking token approvals shows.
4. Move after permit signatures: A permit signature that the attacker has not yet submitted does not appear in any approval list. If you gave a signature on the fake page and still hold funds in the wallet, moving to a new address is the safe option.

A revocation only protects what is still in the wallet. It does not bring back tokens already drained. It does, however, stop the drainer from accessing the wallet again later, for example when new stablecoins arrive at the address.

Compensation from Across: where things stand before the post-mortem

Across has pledged to compensate everyone affected in full. “All affected users will be made whole,” the team wrote on November 11, announcing a detailed post-mortem in the coming days. A post-mortem is the final report after a security incident, with a timeline, cause and consequences. On the evening of the attack, Across had already asked affected users to send transaction details.

Across has not yet published a fixed procedure with a form, deadline and payout route. It therefore makes sense to secure your own evidence now: your wallet address, the transaction hashes of the drained amounts, timestamps and screenshots from the block explorer. That lets you support a claim as soon as the procedure is in place. If you lost money, you can also file a report with the police in your country, in many places online.

Phishing warnings and fake refund pages after the attack

Across points out that some wallets and browsers may continue to flag the genuine site as a phishing page for a while. The reason is the blocklists onto which SEAL 911 and Cloudflare put the domain during the attack. According to the team, these warnings should disappear soon.

Hacks with a compensation pledge are often followed by a second wave: fake refund pages, direct messages from supposed support staff and forms asking for the seed phrase. The seed phrase is the list of words that can fully restore a wallet. No legitimate compensation procedure asks for it. Information on refunds comes exclusively through Across’s official channels; links in replies under the team’s posts or in private messages are not among them.

The registrar as a weak point: Name.com, Namecheap and DNS

The Across case is not isolated. Only at the start of November, attackers took over several domains via the registrar Name.com and planted a drainer on twelve DeFi sites, as we described in our article on the hijacked Name.com domains. The pattern is the same: the contracts on the blockchain are secure, the web interface in front of them is not.

For users, this means a bookmark alone offers no protection, since the address is correct. Habits protect better: grant approvals only for the amount needed rather than unlimited, keep larger sums on an address that is never connected to DeFi sites, and clean up approvals regularly. Hardware wallets help in that they show every signature on their own display; they do not prevent a malicious approval that you knowingly confirm.

Investors have also come across Across recently through its own token, ACX: Bitvavo delisted ACX on October 27, as our report on the ACX delisting at Bitvavo shows. That has nothing to do with the domain attack; the token itself was not the drainer’s target.

Across Bridge hack: until the post-mortem, checking approvals comes first

1. Clean up approvals: Check every wallet you connected to across.to during the window and revoke suspicious approvals. If you often switch between networks, our software wallet comparison lists providers that display signatures clearly before you confirm.
2. Keep evidence: Note your address, transaction hashes and timestamps so that you can support your compensation claim with Across once the procedure is published.
3. Switch networks without your own approval: If you only occasionally move coins between blockchains, you can do it through an exchange that offers deposits and withdrawals on several networks. Which providers can do this and at what fees is shown in the comparison of the best crypto exchanges.

(As of November 11, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)