Hackers Seize Across Protocol Domain Before Access Gets Restored
Domain registrar Namecheap became the target of a social engineering operation that enabled attackers to redirect the cross-chain bridge's visitors to a fraudulent phishing website.
The cross-chain bridge platform Across Protocol announced it has successfully recovered control over its web domain following a Tuesday incident in which a social engineering operation allowed malicious actors to take over its domain and substitute the legitimate website with a fraudulent phishing page.
According to a Wednesday statement, Across confirmed that the across.to domain has been returned to their custody thanks to assistance from Namecheap founder Richard Kirkendall, with all platform operations now functioning as expected.
"All affected users will be made whole. We'll share a full post-mortem in the coming days," the team said on X.
The announcement comes after Across issued a Tuesday alert urging users to stay away from its application following multiple reports of cryptocurrency wallets being drained. The platform has not yet revealed the total amount of losses or the exact number of users impacted by the breach.
Across attributes takeover to social engineering
In a previous communication, Across explained that a social engineering campaign directed at its domain registrar, Namecheap, resulted in an attacker gaining unauthorized control of its domain around 18:45 UTC.
According to the team's account, they received notification of the compromise within a 15-minute window and took immediate action to take the website offline. The security response organization SEAL911 assisted in getting the domain flagged as a phishing threat across major wallet providers, while Cloudflare designated it as risky before ultimately deleting its DNS records.
The team acknowledged that certain users who accessed the domain prior to the complete blocking of the fraudulent site may have fallen victim to the attack. However, third-party integrations and API users remained unaffected by the incident.
The security breach impacted one of the most active cross-chain bridges based on trading volume. According to DefiLlama data, Across held the third position in terms of 30-day transfer volume, trailing behind Circle and LayerZero, with approximately $5.9 billion in transactions processed during that timeframe.