Across across.to domain hijacked via registrar social engineering; drainer approvals still open on six chains

Summary

Across states that at about 18:45 UTC on 10 November 2026 a social engineering attack on its domain registrar, Namecheap, gave an attacker control of the across.to domain, which then served a malicious site. Across says it was alerted within 15 minutes and shut the site down; SEAL911 flagged the domain as phishing with major wallets, and Cloudflare marked it as at risk and later removed its DNS records. Across later reported that it had regained control of the domain. Across's smart contracts were not reported as affected.

Affected

• Users who, on 10 November 2026, visited across.to and connected a wallet, approved a token, signed a message or Permit/Permit2 permit, or sent a transaction
• Networks named in Across's recovery guide: Ethereum, Base, Arbitrum, Ink, Plasma, BNB Chain (the guide warns the same malicious contracts may exist on other networks)
• Fixed: domain recovered and phishing site removed; approvals and unsubmitted permits already granted remain exploitable until revoked

Impact

According to Across's recovery guide, the malicious site asked users to sign token approvals and Permit2 permits that let attacker-controlled contracts move tokens out of their wallets, and some of these approvals are still open; any tokens arriving in an affected wallet can still be taken. Multiple users reported unauthorized withdrawals. The total amount stolen has not been disclosed. Across says all affected users will be made whole. Exploitation is confirmed.

Recommended actions

• Revoke any approval or Permit2 allowance whose spender is one of the indicators below, on every network you use (type https://revoke.cash yourself; do not follow revoke links received by DM, reply or email).
• If you signed anything on across.to on 10 November, move remaining assets to a new wallet: signed but unsubmitted permits are not visible and cannot be revoked.
• If you cannot revoke immediately, move affected tokens out of the wallet.
• Wallets, dapps and exchanges: block the spender and receiver addresses below. Never send funds to them.
• Report losses to Across through its official account; Across will not DM first or ask for a seed phrase.

Indicators

The spender (drainer) contracts and attacker receiving addresses below are copied verbatim from Across's recovery guide. 0xCERT observed that the listed spender contracts on Ethereum, Base, Arbitrum and BNB Chain carry identical bytecode, consistent with the guide's statement that they run the same malicious code. The legitimate across.to domain is not an indicator.

Source & attribution

This 0xCERT advisory summarises Across's disclosure (https://x.com/AcrossProtocol/status/2120278803318489362, initial warning https://x.com/AcrossProtocol/status/2120231513459433747) and Across's recovery guide (https://docs.google.com/document/d/1IW3_cSr9fANfxHSXgVnzQ89Bitqv00Xbk-8bhx3L3kM), corroborated by DefiLlama's hacks dataset and DeFi Prime's report (https://defiprime.com/across-domain-takeover). Details may change; refer to the original sources for the authoritative record.