Mentioned in This Article
1. Across Protocol issues a stop-use warning
Across Protocol, a crosschain bridge that moves assets between Ethereum (ETH) and other networks, warned users on Tuesday, November 10, to stop opening its app, connecting wallets or signing any transaction or approval until further notice. The team said it is investigating a potential security incident, while several users reported losing funds after using the platform.
The alert was posted on the project's account on the social platform X and was brief. It asked people to stay away from the application entirely, and it singled out the two actions that put funds at risk in decentralized finance: authorizing a transaction and granting a token approval. No time frame was given for when normal use might resume.
The team did not describe the nature of the incident, and it did not say whether its website had been compromised. The investigation concerns a potential security problem affecting the project's domain, the web address through which most people reach the bridge, but Across has not confirmed a cause or said how many people may be affected.
2. Is Across Protocol safe to use right now?
By the project's own instruction, no: as of its November 10 warning, Across has told users not to visit the app, connect a wallet or sign anything there until it says otherwise. That guidance stands until the team issues an update, and it applies regardless of whether a particular user has seen anything unusual.
The warning is precautionary in its wording, since the team has not confirmed what went wrong. But the instruction itself is unambiguous, and it covers every interaction with the interface. A person who has a transfer in mind should wait rather than try to complete it, and anyone prompted to approve or sign something on the site should decline.
The alert also leaves open questions that matter for assessing risk. It does not say whether the problem is limited to the website, and it does not address the status of the bridge's underlying operations. Until Across publishes its findings, users have only the instruction to stay away and the accounts of people who say they lost money.
3. What users say they lost
Three accounts posted publicly give a sense of the complaints. One user said they lost $9,000 in USD Coin (USDC), the dollar-pegged stablecoin. Across replied to that person directly, and the exchange was visible on X.
A second user reported a loss of 7,053 USDT0, a token on the Plasma blockchain, and said the funds left in seven separate transactions rather than one. A third said their wallet was drained after they had used the bridge several times, and attributed the loss to a compromised website.
Across asked the affected users to share their transaction details so the team could look into each case. None of the three reports has been independently verified, and the project had not publicly responded to a request for comment on the incident beyond its posts on X. The figures above are therefore individual claims, not a confirmed tally, and Across has given no estimate of total losses.
4. What remains unknown
The gaps in the public record are substantial. Across has not said what the incident is. It has not confirmed that its website or domain was taken over, tampered with or otherwise compromised, even though at least one affected user believes that is what happened. It has not said when the problem began, how long the app may have been unsafe, or whether funds lost by users can be traced or recovered.
There is also no confirmed link, at this stage, between the warning and each of the reported losses. The team's request for transaction details suggests it is still working to establish what happened to the users who came forward. Until that work is finished, the reports and the warning are best read as two related facts: the project believes something may be wrong, and several people say their funds are gone.
This distinction matters for anyone trying to judge their own exposure. A user who has not interacted with the app recently is in a different position from one who connected a wallet or signed an approval shortly before the alert. Across has not yet given guidance that separates those cases, which is one reason its instruction is a blanket one.
5. Why signing on a compromised site can empty a wallet
Decentralized applications are made of two layers, and understanding the split explains why a problem with a website alone can be serious. The first layer is the set of smart contracts that hold and move funds on a blockchain. The second is the website, often called the front end, that people use to build and submit transactions to those contracts. The front end is ordinary web infrastructure, served from a domain like any other site.
When a user clicks a button on a bridge's website, the site prepares a transaction and passes it to the user's wallet for a signature. The wallet shows a prompt, the user confirms it, and the transaction is sent. If the website has been altered, the transaction it prepares may not be the one the user expects. Instead of a transfer to the bridge, it may be an approval that lets another address spend the user's tokens, or a direct transfer to an address controlled by someone else.
Token approvals are a particular hazard. An approval is a standing permission, recorded on the blockchain, that allows a specified address to move a given token out of the user's wallet. Legitimate applications rely on approvals to function. A malicious one can use the same mechanism to withdraw tokens later, in one transaction or several, without asking the user to sign again.
That is why the Across warning names approvals alongside transactions, and why its instruction covers connecting a wallet at all. None of this establishes what happened in this case. Across has not said its site was compromised, and the mechanism behind the reported losses has not been confirmed. The general pattern simply explains why a project that suspects a problem with its domain would tell users to stop signing immediately rather than wait for a full diagnosis.
6. What is Across Protocol?
Across is a crosschain bridge, a service that lets users move assets from one blockchain to another. Its main use is shifting tokens between Ethereum and other networks, sparing users the slower or more expensive routes that would otherwise be needed to get funds from one chain to the next.
Bridges occupy a sensitive position in decentralized finance. Blockchains do not communicate with each other natively, so a bridge has to accept an asset on one network and make an equivalent amount available on another. Users interact with them frequently and often with stablecoins, which is consistent with the losses reported on November 10: both of the specific figures cited by users involved dollar-linked tokens.
Because bridges are used repeatedly, their users tend to return to the same website and sign similar prompts each time. One of the people who reported a loss said their wallet was emptied after they had used the bridge several times. Familiarity with a routine interface can make an unexpected prompt harder to notice, which is part of why projects ask users to stay away entirely when the integrity of a site is in doubt.
7. A separate breach at NEAR AI
The Across alert came one day after an unrelated security disclosure elsewhere in the industry. On Monday, November 9, NEAR AI said attackers had exploited a vulnerability in its artificial intelligence infrastructure, exposing account details for about 100 users and data from 18 AI agents.
According to the company's incident report, the intruders used a remote code execution flaw in SGLang, an open-source engine for running AI models, to reach an internal server and other parts of its infrastructure. A remote code execution flaw is a class of vulnerability that lets an outsider run commands on a machine they should not control. The exposed information included usernames, email addresses, agent chat histories, settings and logs, and two customers had API keys exposed.
NEAR AI also said the attackers may have been able to see requests processed on the compromised server, including requests made in its confidential mode. The company said it has patched the flaw, revoked the credentials that were exposed and restored access to its cloud services. The two incidents are not connected, but together they made for consecutive days of security warnings from crypto-related projects.
8. What happens next
The next development to watch for is an update from Across itself. The team's warning runs until further notice, so the instruction to avoid the app remains in force until the project says the investigation has concluded or that the interface is safe to use again.
A fuller account would need to answer the questions the first alert left open: what the incident was, whether the domain or website was compromised, how many users were affected, and how much was lost. Across has asked people who lost funds to provide transaction details, and those records are likely to shape whatever findings the team publishes.
Until then, the confirmed facts are limited. Across has told its users to stop using the app and to sign nothing. At least three people say they lost funds, including $9,000 in USDC and 7,053 USDT0. The cause has not been established, and none of the losses has been independently verified.