Across reports restored domain control after its website was replaced with a phishing page

Across Protocol said on 11 November that it had regained control of its website and restored normal systems after a domain hijack the previous day. It attributes the takeover to social engineering at its registrar, Namecheap. A reimbursement pledge is not evidence that affected users have already been repaid.

According to the team's account quoted by Cointelegraph, an attacker gained control of the domain at about 18:45 UTC on 10 November. Across says it was alerted within 15 minutes and worked to shut down the malicious frontend. SEAL911 helped flag the address to wallets, and Cloudflare subsequently removed DNS records associated with the phishing page.

The distinction matters for users who encountered a familiar address. This was a takeover of the website's entry point; the report does not establish an exploit of the bridge's core contracts. Across says third-party integrations and API users were unaffected, while visitors who used the compromised site before it was blocked may have been exposed. A correct-looking domain alone was therefore insufficient to establish that the interface was genuine.

The team says affected users will be made whole and promises a fuller post-mortem. The total loss and number of affected users were not disclosed in the recovery report. Those figures and completed reimbursements remain separate evidence to await. People who interacted during the incident should use the team's incident guidance to assess permissions, rather than assuming that restoration of the page reverses every earlier wallet interaction.