Across Protocol bridge domain hijacked and replaced with phishing site

The Across Protocol bridge lost control of its across.to domain on November 10. After a social engineering attack on registrar Namecheap, attackers swapped the site for a phishing copy. The next day the team said the domain was back and that all affected users would be made whole. The total loss has not been disclosed yet.

A phishing site in place of the bridge interface

According to the team, attackers took control of the domain at about 18:45 UTC on Tuesday. They used social engineering against Namecheap and redirected visitors to a phishing site. Third-party integrations and API users, the team said, were not affected.

For a user this is the worst case. The address in the browser is the same, and the transaction signature leads to the attacker's wallet.

Fifteen minutes to react

The team says it was alerted within 15 minutes and began shutting the site down at once. Response group SEAL911 helped flag the domain as phishing with major wallets. Cloudflare first marked it as at risk and later removed its DNS records. Users who opened the domain before it was fully blocked may have been affected.

On Tuesday the warning was terse. Do not open the app, do not sign transactions or approvals, do not connect wallets. The team did not specify the nature of the incident at that point.

The third-largest bridge by transfer volume

According to DefiLlama, Across processed about $5.9 billion over 30 days and ranked third by cross-chain transfer volume, behind Circle and LayerZero. So the hit landed on one of the busiest routes between Ethereum and other blockchains.

What is known about the losses

The total amount and the number of affected users are not disclosed. On X, one user wrote about losing $9,000 in USDC, another about 7,053 USDT0 across seven transactions on the Plasma network. A third described a drained wallet after using the bridge several times. Cointelegraph did not independently verify these reports.

"All affected users will be made whole. We'll share a full post-mortem in the coming days."

- Across Protocol team, from an X post on November 11, 2026

What bridge users should do

• Open the bridge from a bookmark, not from search or a message.
• A separate wallet for bridging, with a small balance left on it.
• Check what the wallet is actually signing and revoke extra approvals after the operation.
• During an official warning from the team, sign nothing until it is updated.

Bridges are convenient, but they add one more point of trust. To move USDT between networks there are other routes, for example an exchange through a service where you do not need to connect a wallet to someone else's interface.

What comes next

Across promises a full post-mortem in the coming days. Until it lands, three questions stay open, namely how many users were hit, for how much, and how the attackers got past the registrar's defenses. The blow fell on the domain, not on the contract code.