Across Regains Domain Control After Phishing Attack Drained About $350,000

Across Protocol said on November 11 that it had regained control of its across.to domain after a phishing attack that GoPlus estimated drained approximately $350,000, according to FinanceFeeds. The cross-chain bridge said the attack began at around 18:45 UTC on November 10.

How the Across Domain Takeover Unfolded

Across received an alert within about 15 minutes and began trying to disable the compromised site. The security response group SEAL911 flagged the domain with major wallet providers, and Cloudflare eventually removed its DNS records. Across said the domain was back under its control with assistance from Namecheap founder Richard Kirkendall and that all systems were operating normally.

The incident did not involve a disclosed compromise of Across's smart contracts. Control of the legitimate domain let attackers replace the project's frontend with a malicious site while visitors still believed they were interacting with Across. The phishing interface tried to persuade users to sign malicious token approvals and permit authorizations, which can give another address permission to transfer assets without the victim approving each later transaction.

GoPlus estimated the losses across Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma. Across has not independently confirmed that figure or disclosed how many users were affected. Across said third-party integrations and API users were unaffected, limiting the known exposure to users who interacted with the compromised website during the attack window. The protocol has pledged to compensate affected users and plans to publish a full post-mortem.

Across's Corporate Transition and Funding Record

Across Protocol is a cross-chain bridge and swap protocol operated by Risk Labs, according to akta.pro company records. The same records list a $41 million initial coin offering in March 2025 led by Paradigm and a $10 million round in November 2022, for total funding of $51 million. The records describe a proposed shift from a token and DAO governance structure to equity and a corporate setup, citing difficulties forming partnerships and growing under the current model.

Earlier Incidents and the ACX Wind-Down

On July 26, 2026, AInvest reported that an attacker exploited a bug in Risk Labs' off-chain Solana relayer software on July 17, 2026, draining approximately $4.5 million from Across Protocol through 1,627 forged deposits with a face value of $41.7 million across 18 destination chains. On July 28, 2026, ChainCatcher reported that PeckShield monitoring showed the attacker had returned 331.8 ETH, valued at approximately $623,900, to the project's Hub Pool Owner multi-signature address. On September 19, 2026, AInvest reported that Across Protocol had restructured as AcrossCo, permanently deprecating the ACX governance token by January 8, 2027, with holders required to exchange tokens for equity or USDC at $0.04375 per token.

What Across Has Said Comes Next

Across plans to publish a full post-mortem of the November 10 incident. The protocol has pledged to compensate affected users.