Cross-chain bridge Across Protocol said it has restored its website after attackers seized control of its domain through a social engineering attack on Tuesday and replaced the site with a phishing page.

Domain-level compromises matter because they turn a project’s most trusted touchpoint against its users: whoever controls the web address can serve malicious pages to visitors directly, without breaching the protocol’s underlying systems.

In an update posted on X on Wednesday, the team said the across.to domain is back under its control with assistance from Namecheap founder Richard Kirkendall, adding that all systems are now operating normally.

“All affected users will be made whole. We’ll share a full post-mortem in the coming days,” the team said.

The announcement follows Across’s warning on Tuesday, when it told users to avoid its application amid reports of drained wallets. The protocol has not yet disclosed the total losses or the number of users affected, leaving its promised post-mortem and the process for compensating affected users as the key items to watch.

Social engineering attack on the registrar

In an earlier update, Across said the attack targeted its domain registrar, Namecheap, through social engineering — attacks that rely on deceiving people rather than breaking code — handing the attacker control of its domain at approximately 18:45 UTC. The team said it was alerted within 15 minutes and moved immediately to shut the website down, a response window that limits how long a hijacked domain can serve malicious content to visitors.

Security response group SEAL911 helped flag the domain as phishing across major wallets, while Cloudflare marked the domain as at risk and later removed its DNS records, the settings that determine where a domain’s traffic is directed.

Across cautioned that some users who visited the domain before the malicious site was fully blocked may have been affected. Third-party integrations and API users were unaffected, the team said.

The incident hit one of the largest cross-chain bridges by trading activity. Across ranked third by 30-day transfer volume, behind Circle and LayerZero, according to DefiLlama, having processed roughly $5.9 billion over that period. Bridges move large volumes of user funds between blockchains, and compromises of user-facing infrastructure such as domains and front ends are a recurring risk in the sector because they target users through trusted interfaces rather than the protocols’ contracts themselves.

Related: Across Protocol warns users to avoid app amid reports of drained wallets