Across Protocol domain hijack (November 2026) hack — November 2026

At about 18:45 UTC on 10 November 2026 an attacker took control of across.to, the web address of the Across Protocol bridge, through a social engineering attack on its domain registrar, Namecheap. For roughly three hours the address served a copy of the app that asked visitors to sign approvals and permits for a wallet drainer. Across says it was alerted within 15 minutes; SEAL 911 had the domain flagged as phishing in major wallets and Cloudflare later pulled its DNS records. Across's contracts, third-party integrations and API users were not affected. Across regained the domain on 11 November.

Bitquery traced $348,000 taken from nine wallets on Ethereum, Arbitrum, Base, BNB Chain and Optimism between 19:02 and 21:53 UTC, valued at each drain; one Aave depositor lost about $305,000 of it after signing a permit. Each drain was split 80% to the thief and 20% to the drainer kit's fee wallet. A widely shared figure of $294,000 matches that fee wallet's balance, most of which predates the hijack, so it is not used here.

Across has said all affected users will be made whole and promised a post-mortem. Until the repayment is confirmed the outcome stays unresolved. The same method hit 12 DeFi sites through Name.com in October 2026.