Across Plans to Compensate Users After Its Domain Was Hijacked

Across plans to compensate users who may have been exposed after an attacker took control of its across.to domain through a social-engineering attack on its registrar, the protocol said.

Across, a cross-chain protocol, said the attack on its registrar, Namecheap, gave attackers control of across.to at about 1:45 p.m. ET Tuesday, Nov. 10 (18:45 UTC). The team received an alert within 15 minutes and began shutting down the site.

Cloudflare later removed the domain's DNS records, making the phishing site inaccessible. Across said people who had visited across.to before the shutdown may have been affected, while third-party integrations and API users were not affected by the incident.

Across did not disclose an amount of financial losses tied to the incident. It urged potentially affected visitors to revoke permissions they granted through the site and said all affected users will be compensated. Its frontend and API will remain offline until domain security is restored.