Across Protocol has regained control of its across.to domain following a social engineering attack on its domain registrar, Namecheap, that briefly redirected visitors to a phishing site. The team announced the recovery on Wednesday, one day after attackers took over the domain, and said all systems are now working normally.

The incident, which began on Tuesday, prompted urgent warnings from the protocol as some users reported drained wallets. Across said all affected users will be made whole and pledged to publish a full post-mortem in the coming days.

Domain Recovered After Registrar Attack

The recovery was publicized in a post on X from the account Crypto Patel:

Across Protocol Recovers Domain After Hijack Attack @AcrossProtocol has regained control of " " following a social engineering attack targeting its domain registrar, Namecheap. The attacker briefly took control of the official domain, exposing users to a… pic.twitter.com/PpKqN8acmx — Crypto Patel (@CryptoPatel) November 11, 2026

How the Attack Unfolded

The attack began on Tuesday at about 18:45 UTC. According to Across, a social engineering attack on its domain registrar, Namecheap, gave an attacker control of the across.to domain. Social engineering attacks rely on deceiving people rather than exploiting technical vulnerabilities to gain unauthorized access.

Once in control of the domain, the attacker replaced the site with a phishing page. Phishing pages are fraudulent sites designed to trick visitors into connecting wallets or approving malicious transactions.

The episode also underscores that a protocol's security depends on more than its own code: because users reach bridge front-ends through domain names, off-chain infrastructure such as registrars and DNS records is itself part of the attack surface.

Response and Recovery

Across said it was alerted within 15 minutes. The team then worked to shut the website down right away, and other groups joined the effort to limit the damage.

Security response group SEAL911 helped flag the domain as phishing with major wallets. Cloudflare marked the domain as at risk and later removed the DNS records for the domain.

Across said it got the domain back with help from Namecheap founder Richard Kirkendall. The team shared the news on X and said it will publish a full post-mortem in the coming days.

“All affected users will be made whole,” the team said. Across has not said how much money was lost, and it has not said how many users were affected — figures the promised post-mortem may clarify.

Warnings and Reports of Drained Wallets

On Tuesday, Across warned users not to use its app or connect their wallets, and told them not to sign any transactions or approvals. The team said it was investigating a possible security incident. At that time, Across did not say what had happened or whether the website had been compromised.

Users soon began posting about losses on X. One user said they lost $9,000 in USDC. Another said they lost 7,053 USDT0 over seven transactions on the Plasma blockchain. A third said their wallet was drained after they used the bridge several times.

Cointelegraph reported that it had not independently verified these claims. Across asked users to send transaction details so it could look into each report. The team later said some users who visited the domain before the phishing site was fully blocked may have been affected.

Across said third-party integrations and API users were not affected. Its app on the real domain is now working as normal.

About Across Protocol

Across is a cross-chain bridge that lets users move digital assets between Ethereum and other blockchain networks. According to DefiLlama, a decentralized finance analytics platform, it ranked third among cross-chain bridges by 30-day transfer volume, behind Circle and LayerZero, processing about $5.9 billion over that period. At that scale, the bridge's web domain acts as the entry point for a substantial flow of cross-chain transfers — the same doorway the attacker briefly converted into a phishing risk.

Separate NEAR AI Incident

In a separate case, NEAR AI reported a security issue on Monday. Its incident report, dated Nov. 9, said attackers used a remote code execution flaw in SGLang, an open-source AI inference engine, to reach an internal server and other infrastructure.

About 100 users had account details exposed, along with data from 18 AI agents. The exposed information included names, email addresses, chat histories, settings and logs. API keys belonging to two customers were also exposed.

NEAR AI said attackers may have seen requests handled on the server, including some in confidential mode. The company said it patched the flaw, revoked the exposed credentials and restored access to its cloud services. NEAR AI said this breach was separate from the Across incident.

As of Wednesday, Across has regained its domain and says it will share a full post-mortem soon. The report, together with any disclosure of total losses and reimbursement details, is the main development to watch as the incident's full scope emerges.