# Across Protocol Hijack: When the Real Domain Serves the Phishing Page

> On 10 November attackers took over across.to through its registrar and put a wallet-draining page on the real address. What happened and what to check.

Canonical: https://www.phishclean.com/blog/across-protocol-domain-hijack-phishing
Last updated: 2026-11-12

November 12, 2026 - 4 min read

By [Chidambaram](https://www.phishclean.com/author/chidambaram), founder of PhishClean

"Check the address before you connect your wallet" is the first rule of crypto safety. On 10 November it did not help: the address was right, and the page behind it belonged to a thief.

## What happened

- **10 November, about 18:45 UTC.** An attacker gained control of across.to, the website of the cross-chain bridge Across Protocol. Across says the way in was a social engineering attack on its domain registrar, Namecheap. The details have not been published.
- **The page.** The attacker changed the domain's settings so that the address showed a phishing page. Across's smart contracts were not touched. According to the security firm GoPlus, visitors could be asked to sign token approvals (EIP-2612 permits, Permit2 authorisations or direct approvals), which let someone else move their tokens, or to send funds straight to the attacker.
- **The response.** Across says it was alerted within 15 minutes. The SEAL911 volunteer group had the address flagged as phishing in major wallets, and Cloudflare marked it as dangerous and removed its DNS records.
- **11 November.** Across said it had the domain back, with help from Namecheap's founder, and that everything was working normally.
- **The cost.** GoPlus estimates nearly $350,000 was lost across Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma. Across has not confirmed a figure. It says affected users "will be made whole" and has promised a full account of the incident.

## Why the usual advice failed

Most phishing uses a wrong address that looks right: a swapped letter, an extra word, a different ending. Every habit we teach, and most security tools, are built around spotting that difference.

Here there was no difference. The bookmark was correct, the padlock was there, and the name in the address bar was the real one. The attack happened one level up, at the company that holds the domain's registration. Whoever controls that account decides where the name points.

This is not new and not limited to crypto. Other DeFi sites were hijacked the same way on 31 October, according to Blockaid. Any website is only as safe as its registrar account.

## If you used Across on 10 November

- **Review your approvals.** Across advises checking and revoking any token approvals granted that day, using a tool such as Revoke.cash. Do this for every chain you use.
- **Revoking is not a refund.** It stops future transfers under an approval. It cannot undo a transfer that already happened, and some signed permits can still be used until they expire, so move what remains to a fresh wallet if you signed anything.
- **Expect follow-up scams.** People who lost money are now being targeted by fake "recovery" and "compensation" accounts. Across says to deal only with its official account.

## What protects you when the address is real

- **Read what you sign.** A bridge needs to move the tokens you are bridging, once. A request for unlimited approval, or for a token you are not sending, is the warning sign. This is the one check that still worked on 10 November.
- **Use a wallet that simulates transactions** and shows what will leave your account before you confirm.
- **Keep savings and spending apart.** Connect a wallet that holds only what you are about to use.
- **Never type a recovery phrase into a website.** No bridge, exchange or wallet needs it in a web page.

## If you run a website

Your registrar login is worth more than your server password. Turn on a registrar lock, use a hardware key or passkey on the account, remove old team members, and ask the registrar what proof it needs before it changes account details over chat or phone.

What PhishClean does and doesn't do here: once a hijacked address is on the reported-phishing list, PhishClean blocks it, and it warns before you paste a recovery phrase into any website. It does not read wallet transactions, so it would not have flagged a token approval on the real across.to in the first minutes. Your wallet's own warnings are the defence for that.

## Sources

- [Cointelegraph, 11 November 2026](https://cointelegraph.com/news/across-protocol-restores-website-after-hackers-hijack-domain): timeline, Across's statements, recovery.
- [crypto.news, 11 November 2026](https://crypto.news/across-protocol-domain-hijack-phishing-350k-losses): the GoPlus loss estimate, chains, and approval advice.

[Paste GuardA warning before a recovery phrase goes into a web page.](https://www.phishclean.com/blog/whats-new-phishclean-1-10-0) [How to check if a website is safeSeven signals, and what each one can't tell you.](https://www.phishclean.com/blog/how-to-check-if-website-is-safe) [How to report a phishing websiteWhere a report actually gets a page blocked.](https://www.phishclean.com/blog/how-to-report-phishing-website) [I clicked a phishing linkA recovery checklist.](https://www.phishclean.com/help/clicked-a-phishing-link)

## Try every check for 7 days

No account needed to start, and five checks stay free afterwards.

[Install PhishClean free](https://www.phishclean.com/#install)

Last updated: 12 November 2026