Across Protocol Pledges Repayment After Domain Hijack

Plasma records corroborate a 7,053 USDT0 loss report

Plasmascan records show seven outgoing USDT0 transfers from the wallet identified by one user, between 19:13:48 and 19:14:56 UTC Tuesday. Two of those transfers accounted for nearly the entire amount. Both receiving addresses appear in Across’s recovery guide as recipients of stolen funds.

Another user reported losing about $9,000 in USDC, and a third said their wallet was drained after using the bridge. Across asked users for transaction details, Cointelegraph reported. Those additional reports could not be independently verified.

CoinGecko’s ACX market page showed the token at about $0.0441, within a 24-hour range of $0.0431 to $0.0462. CurrencyBeacon’s historical data put the Nov. 9 close at about $0.0443.

Across restores its bridge after the domain takeover

In its incident disclosure, Across said the attacker gained control of the domain at about 18:45 UTC through social engineering targeting its registrar, Namecheap. The team said it received an alert within 15 minutes and began taking the site down. Security group SEAL911 helped flag the site for wallets, and Cloudflare later removed the records that directed traffic to it.

Across said people who accessed the bridge through third-party integrations or the API were unaffected by the attack. Its account of the theft focused on the website, where visitors were prompted to give permissions that let others move tokens out of their wallets. The team later warned that some browser and wallet alerts could persist after restoration.

The episode follows other incidents where a wallet or website exposed users to theft through a service they already trusted. In the separate Keplr and Web3Auth breach, investigators traced millions of dollars in movements that were later identified as largely part of a recovery effort. In the Across case, the project itself identified addresses that received stolen funds.

Across tells users to revoke wallet approvals

Across’s guide tells people who connected a wallet, signed a message, approved tokens or sent a transaction on the affected site to review that wallet’s permissions on every network they use. It says to type the address for Revoke.cash directly into the browser and warns against following links sent in messages or replies.

Restoring the website does not cancel permissions already recorded on a blockchain. The guide also says that a signed permission may be invisible until someone submits it. Across recommends revoking visible malicious permissions and moving remaining assets to a new wallet if a user signed anything on the affected site.

“All affected users will be made whole,” Across said in its reimbursement pledge. The team asked people who lost funds to initiate contact through its official account and provide a wallet address and transaction hashes. It said it would never ask for a seed phrase or private key. The pledge follows a separate case in which Mercado Bitcoin said it would absorb losses from theft involving its own wallets and customer deposit addresses.

The broader Crypto Fear & Greed Index fell to 29 on Nov. 11 from 32 a day earlier, remaining in the Fear range.

Across said it would publish a postmortem. The team had yet to disclose how it would validate claims, when it would start reimbursements or how much it expected to pay.