Across Protocol has regained control of its website after a social engineering attack on domain registrar Namecheap redirected visitors to a phishing page. The team said on November 11 that all affected users will be made whole, while an on-chain investigation by Bitquery traced about $348,000 in losses from nine wallets.
Across said in its official update that the takeover began at about 18:45 UTC on November 10 after a social engineering attack on Namecheap gave an attacker control of the across.to domain. The team said it received an alert within 15 minutes and began taking the site offline. The incident is a form of domain hijacking, in which control of a website address can send visitors to an attacker-controlled page.
The fake site used a wallet drainer that asked visitors to sign token approvals or permits, according to Bitquery’s on-chain investigation. Bitquery found that nine wallets lost funds between 19:02 and 21:53 UTC on November 10 across Ethereum, Arbitrum, Base, BNB Chain and Optimism. One Aave depositor accounted for about $305,000 of the total.
Bitquery’s $348,000 estimate differs from the widely shared $294,000 figure, which it said matched the drainer kit’s fee wallet rather than the total stolen. The investigation found that each drain split funds 80/20 between the attacker and the kit’s seller. Across said no third-party integrations or API users were affected and that its systems were operating normally after it regained control of the domain. The phishing tactic resembles fake Trust Wallet website scams, which also use deceptive pages to solicit wallet approvals.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
