1. Across Protocol back in control of across.to
Across Protocol, the cross-chain bridge, said on Wednesday, November 11, that it has regained control of its across.to domain, roughly a day after an attacker took it over on November 10 by socially engineering its registrar, Namecheap, and pointed visitors to a phishing page. The team says all systems are running normally and that every affected user will be made whole.
The update closes the most urgent phase of an incident that began on Tuesday, when Across told its community to stay away from its app as reports of emptied wallets started to circulate. The project credited Namecheap founder Richard Kirkendall with helping it recover the domain, and it said a complete post-mortem will be published in the coming days.
Across has not said how much money was lost or how many people were hit. Those two numbers will likely decide how the episode is remembered, and they are expected to appear in the promised report.
2. How did the Across Protocol domain hijack happen?
The takeover did not come from a flaw in Across's smart contracts or its own servers. Instead, the team says an attacker used social engineering against Namecheap, the company that holds the registration for across.to, and in doing so obtained control of the domain at around 18:45 UTC on Tuesday.
Social engineering, in this setting, means persuading or deceiving the people who run an account rather than breaking its code. A registrar is the gatekeeper for a web address: whoever controls the domain at the registrar can decide which servers the name points to. Once an attacker holds that control, the familiar address in a user's browser can quietly lead somewhere entirely different, even though nothing about the project's own software has changed.
That is what makes this kind of attack so effective against crypto users. People who have used a service many times tend to trust its web address, type it from memory or open it from a bookmark, and then approve whatever their wallet asks them to sign. With the domain redirected, the page that loaded under the across.to name was a phishing site built to trick visitors into handing over access to their funds.
3. The first hours: alerts, takedown and phishing flags
Across says it learned of the hijack within 15 minutes and moved immediately to take the site offline. The speed matters because the damage from a redirected domain grows with every visitor who lands on the malicious page and connects a wallet.
Two outside parties played a role in limiting the exposure. SEAL911, a volunteer security response group that assists crypto projects during active incidents, helped get the domain flagged as a phishing site by major wallets. Those flags are designed to warn users before they connect or sign anything on a dangerous page, which adds a layer of protection that does not depend on people reading social media updates in time.
Cloudflare, the internet infrastructure company, also stepped in. It marked the domain as at risk and later removed its DNS records, the entries that translate a human-readable address into the location of the servers behind it. Pulling those records effectively cut the link between the across.to name and the phishing site, closing the window in which new visitors could be served the malicious page.
4. Who was affected, and who was not
Across has been specific about where the risk sat. The team warned that users who visited the domain in the period before it was fully blocked may have been affected. That group is the focus of the compensation pledge.
At the same time, the project said third-party integrations and users of its API were not affected. That distinction is important for a bridge. Many people never touch a protocol's own website; they reach it through wallets, aggregators and other applications that connect directly to its infrastructure. According to Across, those routes were not exposed, because the attack targeted the domain and the website served under it rather than the underlying systems that partners use.
The separation reflects a broader point about how decentralized applications are built. The website is only one doorway into a protocol. When that doorway is compromised, the contracts and back-end services can remain intact while the people who walk through it are still at risk.
5. What is Across Protocol?
Across Protocol is a cross-chain bridge, a service that lets users move tokens from one blockchain to another. Bridges have become core plumbing in crypto because assets and applications are spread across many separate networks, and moving value between them is not something those networks can do natively.
A bridge typically has several layers: smart contracts that hold or release funds on each chain, back-end services that coordinate transfers, and a website where individual users connect a wallet and request a move. Partners such as wallets and other applications can also plug into the bridge through an API, sending transfers without ever loading the bridge's own web page.
That structure explains why the across.to takeover was dangerous but limited. The website is the layer most ordinary users see, which made it the natural target for an attacker hoping to trick people into signing harmful transactions. The contracts and partner connections sit behind it, and Across says those were not touched by this attack. Because bridges routinely handle large sums for users who must sign transactions to use them, their front ends are an attractive target for phishing whenever a domain can be hijacked.
6. Is Across Protocol safe to use now?
Across says yes: it has regained control of across.to and reports that all systems are operational. The team's earlier advice to avoid the app was tied to the period when the domain was in an attacker's hands, and the project now describes the situation as resolved.
Even so, the full picture will come only with the post-mortem. That document is expected to explain exactly how the attacker convinced the registrar to hand over control, what was changed while the domain was compromised, and what Across and Namecheap are doing to prevent a repeat. Until then, cautious users may prefer to wait for that account before resuming normal activity.
For anyone who did visit the site during the incident, a sensible step is to review which permissions their wallet granted on that day. Phishing pages commonly ask users to approve token allowances or sign messages that let an attacker move funds later, and those approvals can remain active until they are revoked. Across has not published guidance on specific approvals, so the post-mortem should be watched for that detail as well.
7. Repayment promise and the questions still open
In a post on X, the Across team stated that all affected users will be made whole. That is a significant commitment, and it shifts the cost of the incident away from the people who were deceived and onto the project.
What the pledge does not yet include is a number. Across has not disclosed total losses or a count of affected wallets, and it has not described how claims will be identified or paid. Those mechanics usually depend on on-chain analysis to separate transactions signed on the phishing page from ordinary activity, so the details may take time to settle.
The role of Namecheap will also draw attention. Across has framed the takeover as an attack on its registrar rather than on its own systems, and it publicly thanked the registrar's founder for helping it recover the domain. How the registrar's account protections were bypassed is likely to be one of the most closely read parts of the coming report.
8. Why domain attacks remain a weak point for DeFi
Decentralized finance is often described as code that cannot be tampered with, yet most users still reach it through ordinary websites that depend on conventional internet services. Domain registrars, DNS providers and hosting companies are run by people, and people can be fooled. A protocol can secure its contracts thoroughly and still be exposed through an account it does not directly control.
That is why incidents like this one are sometimes grouped under the broad label of a DeFi hack even when no contract was broken. For the user who loses money, the distinction can feel academic. For builders, it highlights how much of a project's security depends on partners further down the chain, from the registrar holding the domain to the wallets that decide whether to show a warning.
The response in this case also shows how the industry's defensive network has developed. A quick internal alert, a volunteer security group able to push phishing flags to major wallets, and an infrastructure provider willing to pull DNS records together narrowed the window of exposure. None of those steps undo losses that had already occurred, but they help explain why the incident was contained within hours rather than days.
9. What comes next for Across
The next milestone is the full post-mortem, which Across says it will publish in the coming days. Users and partners will be looking for three things: a clear timeline of the takeover, the final tally of losses and affected users, and the process for making those users whole.
Until that report arrives, the facts on the record are limited but clear. The across.to domain was seized through a social engineering attack on Namecheap at about 18:45 UTC on November 10, the team detected it within 15 minutes, outside help from SEAL911 and Cloudflare cut off the phishing site, and by November 11 the project said it was back in control with all systems operating normally.
Partners and integrators will also want confirmation of the lessons Across draws for its own setup, from how its domain is held to how quickly warnings can be pushed out in future. The answers will help determine whether this episode is remembered mainly as a registrar failure or as a broader test of how bridges protect the websites their users rely on.