TLDR
- Across Protocol regained control of its across.to domain after a social engineering attack on Namecheap.
- Attackers redirected users to a phishing site on Tuesday, and some users reported drained wallets.
- Across says all affected users will be made whole and a post-mortem is coming.
- Across ranks third among cross-chain bridges by 30-day volume, at about $5.9 billion.
- Separately, NEAR AI reported a data exposure that affected about 100 users.
Across Protocol said it has taken back control of its website. The team posted the update on Wednesday, one day after attackers took over its domain. It said all systems are now working normally.
Across Protocol Recovers Domain After Hijack Attack@AcrossProtocol has regained control of "https://t.co/RmuU4AMQM2" following a social engineering attack targeting its domain registrar, Namecheap.
The attacker briefly took control of the official domain, exposing users to a… pic.twitter.com/PpKqN8acmx
— Crypto Patel (@CryptoPatel) November 11, 2026
The attack began on Tuesday at about 18:45 UTC. Across said a social engineering attack on its domain registrar, Namecheap, gave an attacker control of the across.to domain. The attacker then replaced the site with a phishing page.
How the Team Responded
Across said it was alerted within 15 minutes. The team then worked to shut the website down right away. Other groups joined the effort to limit the damage.
Security response group SEAL911 helped flag the domain as phishing with major wallets. Cloudflare marked the domain as at risk. It later removed the DNS records for the domain.
Across said it got the domain back with help from Namecheap founder Richard Kirkendall. The team shared the news on X. It also said it will publish a full post-mortem in the coming days.
“All affected users will be made whole,” the team said. Across has not said how much money was lost. It has also not said how many users were affected.
Reports of Drained Wallets
On Tuesday, Across warned users not to use its app or connect their wallets. It also told them not to sign any transactions or approvals. The team said it was investigating a possible security incident.
At that time, Across did not say what had happened. It also did not say whether the website had been compromised. Users soon began posting about losses on X.
One user said they lost $9,000 in USDC. Another said they lost 7,053 USDT0 over seven transactions on the Plasma blockchain. A third said their wallet was drained after they used the bridge several times.
Cointelegraph reported that it had not independently verified these claims. Across asked users to send transaction details so it could look into each report. The team later said some users who visited the domain before the phishing site was fully blocked may have been affected.
Across said third-party integrations and API users were not affected. Its app on the real domain is now working as normal.
Across is a cross-chain bridge. It lets users move digital assets between Ethereum and other blockchain networks. According to DefiLlama, it ranked third by 30-day transfer volume, behind Circle and LayerZero. It processed about $5.9 billion over that period.
In a separate case, NEAR AI reported a security issue on Monday. Its incident report, dated Nov. 9, said attackers used a remote code execution flaw in SGLang. SGLang is an open-source AI inference engine.
The attackers reached an internal server and other infrastructure. About 100 users had account details exposed, along with data from 18 AI agents. This included names, email addresses, chat histories, settings and logs.
API keys belonging to two customers were also exposed. NEAR AI said attackers may have seen requests handled on the server, including some in confidential mode. The company said it patched the flaw, revoked the exposed credentials and restored access to its cloud services.
NEAR AI said this breach was separate from the Across incident. As of Wednesday, Across has regained its domain and says it will share a full post-mortem soon.
