CryptoSlate
An Aave depositor lost roughly $305,000 in aWETH during the Nov. 10 hijack of Across Protocol's website, and Bitquery's updated investigation now puts traced losses from the campaign at $401,900 across nine wallets on five blockchains. The funds moved through a signed spending permission requested on the compromised interface, an approval that also put the depositor's separate lending position within the attacker's reach. Across said the domain was taken over through social engineering aimed at its registrar, Namecheap.
Why it matters
The largest single loss came not from a bridge user but from the mechanics of Aave's deposit tokens. aWETH, the interest-bearing token representing an Aave deposit, is transferable, and a signed permit can authorize another account to spend it. Bitquery's reconstruction shows the fake site requested an unlimited approval, followed by 115.23 aWETH sent to the attacker's wallet and 28.81 aWETH to the drainer's fee wallet, matching an 80/20 split. The owner revoked the permission one minute after the final pull, but four transfers over roughly three minutes had already completed.
The revised Nov. 12 tally also adds a previously missed 26.38 ETH sweep worth about $54,000 at the time, and corrects the widely circulated $294,000 figure, which Bitquery says matched the fee wallet's holdings, including funds that predated the attack.
Market impact
Across regained control of its domain on Nov. 11 and pledged to make affected users whole and publish a postmortem, which puts the reimbursement scope question front and center: the biggest victim's loss flowed through Aave, not the bridge itself. The episode is a fresh case study in signature-based approvals, where a single permit signed on a hijacked interface can reach positions far beyond the site a user thought they were interacting with.
Frequently asked questions
-
How did the attacker reach an Aave position through the Across hack?
The compromised Across site requested a signed permit for aWETH, Aave's transferable deposit token. That approval let the attacker move the tokens, which in turn exposed the depositor's separate lending position.
-
How much was lost in total in the Across Protocol website hijack?
Bitquery's Nov. 12 estimate puts traced losses at $401,900 across nine wallets on five blockchains, using prices at the time the assets were stolen. The Aave depositor accounts for about 76% of that total.
-
Why did the earlier $294,000 loss figure change?
Bitquery says that number matched the drainer's fee wallet holdings, including funds that predated the Across attack. The revised tally also adds a previously missed 26.38 ETH sweep valued at about $54,000.
-
What is aWETH and why was it vulnerable to the attacker?
aWETH is an interest-bearing token representing an Aave deposit. It can be transferred, and a signed permit can authorize another account to spend it, which is the mechanism the attacker used after the first unlimited approval.
-
Will victims of the Across Protocol hijack be reimbursed?
Across Protocol regained control of its domain on Nov. 11 and pledged to make affected users whole and publish a postmortem. The scope of reimbursement for losses like the Aave position remains the open question.
WuBlockchain
WatcherGuru
CoinDesk
TheBlock
Crypto Rank News