Across Protocol domain hijacked via Namecheap social engineering, ~$350k drained

At 18:45 UTC on Nov 10, 2026, an attacker took control of Across Protocol's primary domain after a social engineering attack on registrar Namecheap. Across confirmed it on X the next morning; The Block's Nov 11 write-up is the detailed secondary. The phishing site served a fake token-approval flow and drained wallets on Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma. Security firm GoPlus estimates ~$350,000 in losses; Across has pledged to make affected users whole.

What happened

Across's statement is specific about the timeline:

• 18:45 UTC, Nov 10 — a bad actor obtained control of the Across domain via social engineering against Namecheap.
• ~19:00 UTC — Across's monitoring fired; the team began the takedown.
• SEAL911 flagged the hijacked domain as phishing to major wallet providers (MetaMask, Phantom, Coinbase Wallet) so wallet-level warnings surfaced.
• Cloudflare stripped the DNS records, rendering the phishing page unreachable.
• Nov 11 (early UTC) — Across regained the domain, with assistance from Namecheap founder Richard Kirkendall per the Across X post, and restored normal operation.

The attacker did not touch Across's smart contracts. The theft vector was wallets signing malicious approve and EIP-2612 permit calls through a UI pointed at the legitimate across.to hostname.

Losses

GoPlus's estimate (per The Block): ~$350,000 across the six chains above. Across has not published an on-chain tally. Victims were told to revoke token approvals via Revoke.cash immediately, and Across has said all affected users will be made whole.

Numbers

- Registrar                  : Namecheap
- Attack vector              : social engineering against the registrar account
- Site compromise window     : 18:45 UTC Nov 10 → restoration Nov 11 (UTC)
- Detection latency          : ~15 minutes
- Chains with drained wallets: Ethereum, Arbitrum, Base, BNB, Ink, Plasma
- Estimated loss (GoPlus)    : ~$350,000
- Smart-contract impact      : none (domain-level attack)
- Across remediation         : full reimbursement pledged

What to watch

1. The post-mortem. Across has not yet published what went wrong at Namecheap — whether MFA was bypassed, whether a support-channel social-engineer coaxed a password reset, whether a transfer-lock was defeated. The specific failure mode matters for every other protocol with a Namecheap-registered domain.
2. Per-victim reimbursement. The Across X statement commits to making users whole but gives no mechanic, deadline or address list. Expect a follow-up with a claim form or a direct top-up pass.
3. Wallet-vendor UX for registrar-level attacks. The incident is a clean demonstration that a web wallet's hostname whitelisting ("legitimate across.to resolves to this signature-request pattern") is not sufficient when the registrar itself is the compromise point. SEAL911's pager-style escalation path to MetaMask and Phantom is what cut the active phishing window short.
4. Namecheap customer response. The first such takeover against a crypto protocol's registrar in H2 2026; a second within a short window would move the needle for SaaS registrar choice.

Context

Registrar-level takeovers against crypto frontends are not new — Curve, Celer and Compound frontends have all been hit via BGP, DNS or hosting-side compromises in prior cycles — but Namecheap being the specific pivot differs from most prior incidents and matches recent pressure on domain registrars as the softest step in the web2-to-web3 trust chain. Across's ~$350k figure is small by exploit-ledger standards; a two-hour window on a frontend handling hundreds of millions in daily bridge volume could have been far worse, and the short detection-to-takedown gap is the reason it was not.

Sources:

• @AcrossProtocol — statement on the domain hijack (primary, Nov 10–11, 2026).
• The Block — Crosschain protocol Across restores systems after domain hijack (Nov 11, 2026).
• Cointelegraph — Across Protocol restores website after phishing attack (Nov 11, 2026).