TheBlock
Across has regained control of its website and restored normal operations after attackers hijacked its domain and redirected visitors to a phishing site. Security platform GoPlus estimated user losses at $350,000 across six networks. Across said it would make all affected users whole.
The cross-chain protocol said attackers gained control of its domain at around 18:45 UTC on Nov. 10 through a social engineering attack on registrar Namecheap. Across received an alert within 15 minutes and began efforts to take the site offline. It later recovered the domain with Namecheap's assistance.
Why it matters
GoPlus said the fake site induced users to sign token approvals or permits designed to drain their wallets. It reported stolen funds on Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma.
Security response group SEAL911 flagged the phishing domain with major wallet providers, and its DNS records were removed, making the site inaccessible. The incident illustrates how an attack on a domain registrar can expose users across multiple networks without compromising the underlying protocol.
Market impact
Across did not disclose the number of affected users or its own loss estimate. Its commitment to reimburse victims addresses the reported wallet losses, while GoPlus's $350,000 figure remains an estimate.
The attack adds to a broader tally of crypto security losses. DefiLlama data cited in the report puts year-to-date losses from 341 hacks and exploits at $8.78 billion.
Frequently asked questions
-
How did attackers gain control of the Across domain?
Across said attackers used social engineering against its domain registrar, Namecheap, to take control of the website.
-
How did the phishing page drain users' wallets?
GoPlus said the page induced visitors to sign fake token approvals or permits designed to drain their wallets.
-
Which networks had wallets affected by the Across phishing attack?
GoPlus reported stolen funds on Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma.
-
Will Across reimburse users affected by the hijack?
Across said all affected users would be made whole. It did not disclose the number of affected users or its own estimate of losses.
-
How was the phishing site made inaccessible?
SEAL911 flagged the domain with major wallet providers, and its DNS records were removed. Across later recovered control with Namecheap's assistance.
Lookonchain
CoinDesk
WatcherGuru
WuBlockchain