Across Protocol Regains Its Domain After Namecheap Hijack Turned Its Website Into a Phishing Trap

Published November 11, 2026, 2:45 PM PKT. Based on Across Protocol's incident disclosure and restoration update on X (primary source), and reporting by Cointelegraph, CryptoTimes, DefiPrime and Blockchain Academics (secondary sources).

Cross-chain bridge Across Protocol regained control of its website on November 11, 2026, about six and a half hours after an attacker hijacked its domain through a social engineering attack on registrar Namecheap and replaced the site with a phishing page that drained some users' wallets.

Across said the across.to domain is back under its control and all systems are working normally again. The team credited Namecheap founder Richard Kirkendall with helping secure the account, and said an investigation has been opened. "All affected users will be made whole. We'll share a full post-mortem in the coming days," the team said on X.

Security firm GoPlus estimates nearly $350,000 was lost across six chains, Blockchain Academics reported. Across has not confirmed that figure, and has not disclosed its own loss total or the number of affected users.

How the domain was taken at 18:45 UTC

In its incident disclosure, Across said the attack began at approximately 18:45 UTC on November 10, 2026. A social engineering attack on Namecheap, its domain registrar, gave the attacker control of the across.to domain, and the attacker changed the domain settings so visitors landed on a phishing page instead of the real Across app.

Across said its domain had been locked down with what it called best-in-class security practices, and that the "unauthorized takeover should not have been possible." The account of social engineering at Namecheap came from Across, the affected operator, and its investigation was still pending when it published the disclosure.

The attack hit one of the largest cross-chain bridges by trading activity. Across ranked third by 30-day transfer volume, behind Circle and LayerZero, according to DefiLlama, having processed about $5.9 billion over the period, Cointelegraph reported.

Fifteen minutes to the first warning

Across said it was alerted within 15 minutes of the takeover and immediately worked to shut the site down. At around 19:05 UTC, the team issued its first public warning, telling users: "Do NOT visit the app, connect your wallet, or sign any transaction or approval there until further notice."

Security response group SEAL911, the emergency response team of the Security Alliance (SEAL), helped flag across.to as a phishing site with major wallet providers. Cloudflare, the web infrastructure company, marked the domain as at risk and later removed its DNS records, which took the phishing page offline. By the time Across published its disclosure, the team said the domain was fully down and the phishing site was unavailable.

In that disclosure, published at around 22:13 UTC, Across said that "despite our best efforts, @Namecheap has been unresponsive." The team said this left it unable to fully secure the domain and restore services, so it kept both the frontend and the application programming interface (API) offline until the security issue was resolved.

The $350,000 GoPlus estimate across six chains

GoPlus put losses at nearly $350,000 across Ethereum ($ETH), Arbitrum, Base, BNB Chain ($BNB), Ink and Plasma, Blockchain Academics reported. Across has not confirmed the GoPlus figure, and the total losses and number of affected users have not yet been disclosed by the team.

Some users who visited the official website before the phishing page was fully blocked may have been affected, Across said. Users who accessed the site only before the attack were not impacted, and neither were users of third-party integrations or the API.

The distinction matters because the attack targeted the website, not the protocol's contracts. Anyone who connected a wallet to across.to during the exposure window on November 10, approved a token, signed a message or permit, or sent a transaction through the compromised page is in the group Across says should check its recovery guide.

What affected users should do now

Across published a recovery guide for anyone who visited the site on November 10 and connected a wallet, approved a token, signed a message or permit, or sent a transaction. The guide tells users to visit Revoke.cash with the wallet they connected and revoke any permissions granted that day, since approvals signed on the malicious site can still expose tokens after the site itself has been removed.

The guide tells users to type revoke.cash into their browser themselves and to avoid revocation links received in direct messages, replies or emails. Across asked users who believe they were affected to contact the team by direct message on X, and the guide asks people who lost funds to provide their wallet address and transaction hashes.

Across committed to fully compensating affected users, but the reimbursement statement gives no payment date or claims timetable. The team said it will publish a full postmortem explaining how the takeover happened in the coming days.

A top-three bridge goes dark for six and a half hours

From the 18:45 UTC takeover to the restoration announced at around 01:16 UTC on November 11, Across's frontend and API stayed offline for about six and a half hours while the team worked with SEAL911 and Cloudflare to kill the phishing page and regain the domain.

The incident is a reminder that a crypto protocol's website can be its weakest point even when its contracts are untouched. A registrar account, not a smart contract, was the entry point here, and the phishing page needed only a wallet connection and a signed approval to drain funds. Across's own disclosure put it plainly: the domain was locked down with best-in-class practices, and the takeover should not have been possible.

Sources

• Across Protocol, incident disclosure and domain restoration update on X, November 10-11, 2026 (primary source: takeover at approximately 18:45 UTC on November 10, 2026 through a social engineering attack on Namecheap; alert within 15 minutes; first public warning at around 19:05 UTC; disclosure at around 22:13 UTC stating Namecheap was unresponsive and the frontend and API would stay offline; domain restored at around 01:16 UTC on November 11 with help from Namecheap founder Richard Kirkendall; "All affected users will be made whole. We'll share a full post-mortem in the coming days"; users who visited before the attack and users of third-party integrations and the API were unaffected)
• Cointelegraph, Across Protocol Restores Website After Phishing Attack, November 11, 2026 (secondary source: domain back under control with help from Namecheap founder Richard Kirkendall; all systems working normally; SEAL911 flagged the domain as phishing with major wallets; Cloudflare marked it as at risk and later removed its DNS records; Across ranked third by 30-day transfer volume behind Circle and LayerZero, about $5.9 billion processed, according to DefiLlama)
• CryptoTimes, Across Protocol Domain Hijacked via Namecheap Social Engineering Attack, Users to Be Made Whole, November 11, 2026 (secondary source: detailed November 11 incident disclosure posted on X; domain locked down with best-in-class security practices and the takeover should not have been possible; affected users asked to contact the team by direct message on X)
• Blockchain Academics, Across Protocol Regains Domain After Hijack, GoPlus Sees $350K Loss, November 11, 2026 (secondary source: GoPlus estimate of nearly $350,000 lost across Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma; Across has not confirmed the figure)
• DefiPrime, Across domain takeover: frontend offline, approvals at risk, November 11, 2026 (secondary source: recovery guide for anyone who visited on November 10 and connected a wallet, approved a token, signed a message or permit, or sent a transaction; guide tells users to type revoke.cash into their browser themselves and avoid revocation links in direct messages, replies or emails; reimbursement statement gives no payment date or claims timetable)

This article is news reporting and is not investment advice.