Incident Details and Timeline

Across Protocol, a leading cross-chain interoperability platform, reported a security breach on Tuesday that allowed attackers to hijack its domain through a social engineering campaign targeting the registrar Namecheap. The attackers redirected users to a phishing site, prompting the protocol to immediately take its main website offline to limit further damage.

Security experts from SEAL911 and Cloudflare assisted in the response. SEAL911 flagged the domain as phishing and worked with major wallets, while Cloudflare removed DNS records and marked the site at risk. The team was alerted to the takeover within 15 minutes of the attack, which occurred around 18:45 UTC.

Third-party integrations and API users remained unaffected. The disruption impacted one of the largest cross-chain bridges by transfer volume, with the platform having processed roughly $5.9 billion in the preceding 30 days according to DefiLlama rankings.

User Impact and Platform Response

Users who visited the official site before it was fully blocked may have been exposed, and the protocol issued a warning advising against accessing the app or connecting wallets. Reports emerged of drained wallets following interactions with the bridge, including cases involving USDC and USDT transfers on networks like Plasma. The exact number of affected users and total losses remain undisclosed at the time of the restoration update.

In response, Across Protocol confirmed the domain was restored with support from Namecheap founder Richard Kirkendall. All systems are now working normally, and the team stated that every affected user will be made whole.

Reimbursement and Security Measures

The protocol described the user reimbursement as full and linked the website shutdown directly to the domain attack. Affected individuals were encouraged to revoke permissions granted to any suspicious integrations. No additional details on compensation amounts or specific cases were provided in the updates.

Across Protocol continues to operate as a decentralized finance platform focused on seamless asset transfers across Ethereum and other networks. The incident represents a rare example of a registrar-level compromise in the decentralized space, highlighting the importance of strong access controls and rapid incident response even in the absence of a direct code exploit.