Attackers took over the web address of Across Protocol, a crypto bridge, on November 10. People who typed the correct address landed on a copy of the site. It asked their wallets to sign permissions, then emptied them. A security firm estimates losses near $350,000. Across has the address back and says everyone affected will be repaid.

Key facts

  • Who: Across Protocol, a crypto bridge, and its web address company, Namecheap
  • What: The real address, across.to, was hijacked and pointed at a wallet-draining copy of the site
  • When: From about 18:45 UTC on November 10, 2026; address restored November 11
  • How much: Nearly $350,000, an estimate by security firm GoPlus that Across has not confirmed
  • Source: Cointelegraph

The Across Protocol domain hijack began around 18:45 UTC on November 10, or 11:45 am Mountain time. For hours, anyone who typed across.to, the project's real address, was sent to a look-alike page run by thieves, Cointelegraph reported.

Across is a bridge, a service that moves crypto from one blockchain to another. Its own code wasn't broken. The attackers went after the company that holds its web address instead.

How the address was taken

Every website name is registered with a company called a registrar. Across used Namecheap. The attacker tricked their way into control of the across.to name there, a method known as social engineering, CoinCentral reported. Then they pointed the name at their own copy of the app.

The copy asked visitors to connect a wallet and sign an approval. An approval is a permission that lets an app move your tokens. Sign one for a thief and they can take whatever it covers, FinanceFeeds reported.

What was lost

Security firm GoPlus estimates that nearly $350,000 was taken across six networks. Across hasn't confirmed a total or said how many people were hit, Cointelegraph reported. Treat the figure as an early outside estimate.

Across got the address back on November 11 with help from Namecheap's founder, Richard Kirkendall. "All affected users will be made whole. We'll share a full post-mortem in the coming days," the project said. A post-mortem is a written account of what went wrong.

If you used Across on November 10 or 11

If you connected a wallet and signed anything during that window, check your approvals now and cancel any you don't recognize. Our guide shows how to check and revoke token approvals. If funds are already gone, see whether to revoke or move to a new wallet.

A bookmark or a carefully typed address protects you from fake links. It can't protect you when the real address itself is hijacked. The last check is the wallet pop-up. Read what it asks for before you sign, every time.

Sources: Cointelegraph, carried by TradingView, Across Protocol restores website after hackers hijack domain (November 11, 2026), CoinCentral, How Hackers Used Namecheap to Hijack the Across Protocol Domain (November 2026), FinanceFeeds, Across Domain Hijack Drains $350K; Arcus Loses $2.23M (November 2026).