Key Highlights
- Cross-chain bridge Across suffered a front-end security breach after attackers hijacked its domain via a social engineering exploit at registrar Namecheap.
- Security incident response group SEAL911 and Cloudflare coordinated rapidly to flag the domain as phishing, label it as at risk, and take down malicious DNS records.
- While total user losses remain undisclosed, smart contracts, third-party integrations, and API users remained completely unaffected by the domain takeover.
Across Protocol Domain Hijacked via Namecheap Social Engineering Attack
Cross-chain bridge Across has provided critical updates following an urgent warning issued on Tuesday that advised users to avoid interacting with its web application amid emerging reports of drained crypto wallets. The security breach occurred after an unauthorized actor seized control of Across’s primary web domain through an exploit targeting its domain registrar, Namecheap. While community members reported wallet drainage shortly after visiting the compromised portal, the protocol’s development team stated that the full extent of financial losses and the exact number of impacted users have not yet been disclosed.
According to post-incident disclosures from the Across team, the security compromise occurred at approximately 18:45 UTC when a sophisticated social engineering scheme granted an outside attacker administrative dominion over the registrar account. Across developers were alerted to the anomaly within 15 minutes of the takeover and promptly initiated emergency countermeasures to pull down the compromised web interface and mitigate further exposure for incoming web traffic.
Rapid Containment by Cloudflare and SEAL911 Blocks Phishing Interface
In response to the front-end hijacking, Across coordinated with prominent Web3 cybersecurity entities to safeguard ecosystem participants. Industry security response collective SEAL911 stepped in to assist the protocol, working quickly to ensure that major cryptocurrency software wallets flagged the Across domain as a known phishing threat. Concurrently, web infrastructure provider Cloudflare intervened by classifying the website as at risk before completely purging its malicious Domain Name System (DNS) records to halt external traffic routing.
Despite the rapid containment efforts, developers cautioned that certain decentralized finance (DeFi) participants who connected to the domain before security protections were fully deployed might have suffered compromised balances. However, the breach was confined entirely to the web domain layer. The team confirmed that underlying smart contracts, backend infrastructure, third-party integrations, and automated API users were unaffected throughout the attack lifecycle.
Elon Musk Dismisses $120 Billion Anthropic Exit Talk as SpaceX Plans $74 Billion AI Expansion
Why This Matters
The security breach strikes at one of the cryptocurrency sector’s most integral liquidity routes. Across consistently ranks among the industry’s premier cross-chain bridges by volume and activity. DefiLlama metrics show that Across ranked third by 30-day transfer volume—trailing only Circle and LayerZero—after facilitating roughly $5.9 billion in digital asset transfers across that window.
This incident underscores a persistent and dangerous vector in Web3 infrastructure: domain registrar compromise. Even when on-chain smart contracts remain uncompromised and fully solvent, social engineering exploits targeting conventional Web2 infrastructure like DNS managers and domain registrars can expose end-users to dangerous drainer scripts, highlighting an ongoing need for institutional-grade domain security among leading decentralized finance protocols.
Frequently Asked Questions
Were Across smart contracts or liquidity pools compromised?
No. The security incident was strictly confined to a front-end domain hijacking via registrar Namecheap. Across’s underlying bridging contracts, automated APIs, and third-party partner integrations remained secure and unaffected.
How was the compromised Across website neutralized?
Across initiated takedown protocols within 15 minutes of detection, collaborating with Web3 emergency group SEAL911 to tag the site as phishing inside major wallets. Cloudflare then designated the address as at risk and dismantled the attacker’s malicious DNS records.
What should Across bridge users do if they accessed the site during the incident?
Users who interacted with the platform during the compromised window should inspect their wallet transaction history, revoke any suspicious token approvals granted to unknown addresses, and monitor official Across community communication channels for guidance on exposure assessment.
