Across Protocol Regains across.to Domain After 18:45 UTC Hijack

Domain Recovered on Wednesday

The website of Across Protocol, the team behind one of the three busiest cross-chain bridges in decentralized finance, was hijacked on Tuesday and briefly served visitors a phishing page. In an announcement published on Wednesday, Across said the across.to domain is back under its control, that all systems are working normally, and that the recovery was carried out with help from Namecheap founder Richard Kirkendall. The protocol attributes the takeover to a social engineering attack aimed at its domain registrar rather than at any part of its on-chain infrastructure, a distinction that shapes how the whole incident reads.

The trouble surfaced on Tuesday, when Across warned users to stay away from its application while reports circulated of wallets being drained after visits to the fake site. Neither the total amount taken nor the number of wallets touched has been disclosed so far. The team said only that users who reached the malicious site before it was fully blocked may have been affected, and that third-party integrations and API users were untouched. In the Wednesday update, Across committed to making all affected users whole and promised a full post-mortem in the coming days.

The domain is the critical asset in an episode like this: across.to carries the frontend through which users approve transfers, and anyone landing on the spoofed version during the hijack window was exposed to whatever the attackers served. The hijack did not involve the protocol's smart contracts, and the team has claimed no on-chain exploit. Recovery instead required assistance at the registrar level, which shows how dependent a bridge can be on infrastructure it does not itself control, and how little contract audits weigh when the attack arrives by phone or support ticket.

Takeover via Namecheap at 18:45 UTC

The team's own timeline, laid out in an earlier update on X, puts the moment of takeover at approximately 18:45 UTC on Tuesday, when a social engineering attack against Namecheap handed the attacker control of the domain. Across said it was alerted within 15 minutes and immediately began working to shut the website down. Security response group SEAL911 worked with major wallet providers to get the domain flagged as phishing, and Cloudflare marked the address as at risk before removing its DNS records. Those steps narrowed the exposure: a visitor had to reach the domain between the hijack and the full block to face any risk.

The scale behind the name gives the episode weight. Aggregate bridge data shows Across ranked third among bridge protocols by 30-day transfer volume, behind Circle and LayerZero, having processed roughly $5.9 billion over that period. A frontend that carries that flow is itself critical infrastructure, which is why the team kept its warning to avoid the app in place until the domain was recovered. The response also reveals the division of labor in a domain-level incident: a protocol cannot flag its own name as phishing, so wallet providers and infrastructure firms did the blocking while the team worked the registrar directly.

The incident also separates two kinds of names in crypto infrastructure. A registrar-issued domain like across.to can be handed over by a registrar under social pressure, while an on-chain name such as a .ETH domain resolves on the chain itself and has no registrar to call. That difference mattered little to the users who reported drained wallets on Tuesday, but it determines which recovery paths exist for a project after a takeover of this kind. Wednesday's announcement closed the operational phase; the accounting phase, with hard figures, is still pending.

Root Cause Off-Chain, Losses Uncounted

The verifiable root cause is off-chain: nothing in the attack touched the settlement logic, the liquidity pools or the contract machinery, from atomic swap designs to zero-knowledge proofs, that bridge audits are built to check. What cannot be verified yet is the loss itself: the team has published no attacker addresses, no transaction hashes and no dollar total, so the on-chain damage remains uncounted today. The remediation that can be confirmed is the domain, recovered with registrar help, plus the wallet and Cloudflare flags that blunted the attack within minutes. What is left is the team's pledge that every affected user will be made whole. Until the promised post-mortem arrives with figures, that pledge is the only route back for the users who lost funds, and it runs entirely through Across.