Across Protocol warns users to avoid app amid reports of drained wallets
- Published
- Updated
Across Protocol warned users to avoid its app while it investigated a potential security incident involving its domain, after reports that some users had lost funds. The protocol later said its website was restored after a domain hijack that redirected visitors to a phishing site, and one report put estimated user losses at $350,000 with a reimbursement promise.
Key claims & sources
What it means
Domain hijacks have become a recurring attack vector in DeFi: the smart contracts stay secure while the front-end that users trust gets swapped for a lookalike. Across Protocol, a cross-chain bridge built on UMA's optimistic oracle design, relies like most dApps on a conventional domain registrar, Namecheap, for its web address. That Web2 dependency, not the blockchain layer, became the single point of failure here.
Users who interacted with the phishing site during the hijack now face wallet approvals that need revoking and transactions that need checking, since the fake page was built to harvest signatures and drain funds rather than route trades. Across has promised reimbursement for the roughly $350,000 in estimated losses, which shifts the immediate burden from victims to the protocol's treasury. Anyone bookmarking the app directly, rather than searching for it, avoided the redirect entirely.
A protocol can audit its contracts repeatedly and still get compromised through a registrar's customer-support desk, which is precisely what a social engineering attack on Namecheap achieved. This exposes a real tension: decentralized finance markets itself on removing trusted intermediaries, yet almost every user still reaches it through a centralized DNS system that one phone call can subvert. Reimbursement fixes the balance sheet, not the structural weakness underneath it.
Whether Namecheap discloses or changes its domain-transfer verification process will determine if this stays an isolated incident or becomes a template other attackers copy against similar protocols. Across's own follow-through on reimbursing the $350,000 in losses is the near-term marker worth tracking, along with whether other projects using the same registrar move to registry locks or hardware-backed domain controls in response. (per cointelegraph.com)
Market reaction i
Across Protocol rose 0.5% in the 4 hours after the first headline.
16 prices, one every 30 minutes
Coverage timeline
Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.
Cointelegraph
scoop
Cointelegraph
context
Crypto Economy
context
Thefts of a similar size
| When | What happened | Figure |
|---|---|---|
| 2.1 years ago | Kalax · Admin Drain incident | $350k |
| 2.6 years ago | Sumer.money · Reentrancy incident | $350k |
| 3.1 years ago | Balancer · DNS hijacking attack incident | $350k |
| 3.7 years ago | Zircon Gamma · Incorrect share accounting incident | $350k |
| 3.8 years ago | fcdep · Infinite Mint incident | $350k |
4300 incidents stored · 1264 were as large as this one or larger ($350k)