The hijack took place on Tuesday, November 10, 2026, at about 18:45 UTC. An attacker obtained control of the across.to domain from Namecheap through social engineering and pointed the DNS at a booby-trapped site. Across says it was alerted in under fifteen minutes: front end and API taken down, the domain reported by SEAL 911 to the wallets' phishing lists, then Cloudflare flagging it as risky and deleting its DNS records. The bridge's contracts were untouched. Third-party integrations and API clients, which don't go through the domain, were not exposed.
How the fake site worked is not documented. Reports speak of drained wallets, which usually means a signature accepted on the booby-trapped interface: an ERC-20 approval, a permit, or a transfer. The amount lost and the number of victims have not been disclosed. Across promises to compensate every victim and to publish a full post-mortem in the coming days. The domain came back under its control overnight, with help from Namecheap's founder, Richard Kirkendall.
Still open: how Namecheap was talked into it, how long the fake site was served, and in what form the refunds will arrive. For your records, under French tax law a theft is not a disposal within the meaning of Article 150 VH bis of the tax code: it creates no deductible capital loss, and the missing tokens leave the portfolio with no tax effect. A refund received in crypto is, in principle, recorded as an acquisition at that day's price. Transaction hashes and your exchanges with Across will document both lines.
The Across bridge's website was replaced by a fake one for part of Tuesday evening
Across is what's called a bridge, a service that moves your crypto from one network to another, for example from Ethereum to Arbitrum. On Tuesday evening, at about 18:45 UTC, a scammer got hold of the across.to domain name (the site's address) by tricking the company that manages it, Namecheap. The official address then led to a copy of the site, built to empty the crypto wallet of anyone who connected to it. The team says it was alerted within a quarter of an hour and took its site down. The major crypto wallets (MetaMask, Rabby and the others) blocked the address. Across regained control overnight.
If you didn't open across.to on Tuesday evening, there is nothing for you to do. If you did, and you signed something, check your balances and remove the permissions granted that day, using the same crypto wallet (a tool such as revoke.cash does this). Across promises to reimburse every victim, without yet saying how many there are.
Read the intermediate version
Across: the across.to domain hijacked at Namecheap, Tuesday evening's visitors exposed
Across, the third-largest cross-chain bridge by 30-day volume ($5.9 billion according to DefiLlama), lost control of its across.to domain on Tuesday, November 10, 2026, at about 18:45 UTC. There was no flaw in the protocol: the attacker tricked the registrar Namecheap through social engineering and had the domain assigned to them. The official address then pointed to a phishing site.
The team says it was alerted in under fifteen minutes. It took the front end and the API offline, SEAL 911 had the domain reported to the major wallets, and Cloudflare deleted its DNS records, which made it unreachable. The contracts and the apps that go through Across's API were not affected. Overnight, Across recovered the domain with help from Richard Kirkendall, Namecheap's founder, and brought its systems back online.
Only people who opened across.to between the attack and the block are exposed. Several users report drained wallets, but neither the amount nor the number of victims is known. Across commits to reimbursing them in full and will publish an incident report in the coming days. If you went through the site on Tuesday evening, revoke the permissions granted that day, with the wallet you were using at the time.
