-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 0xCERT Security Advisory 0xCERT-2026-0337 ============================================================ Advisory-ID: 0xCERT-2026-0337 Severity: High Published: 2026-11-10T19:05:59.000Z Updated: 2026-11-11T04:43:20.556Z Chains: Ethereum, Base, Arbitrum, BNB Chain, Other / Multi-chain URL: https://www.0xcert.com/advisory/0xCERT-2026-0337 Title: Across across.to domain hijacked via registrar social engineering; drainer approvals still open on six chains Summary - ------- Across's across.to domain was hijacked on 10 Nov 2026 via social engineering at registrar Namecheap and served a drainer that collected token approvals and Permit2 permits. Approvals remain exploitable: anyone who used across.to that day should revoke the listed spender contracts on every chain or move funds to a new wallet. Details - ------- Summary Across states that at about 18:45 UTC on 10 November 2026 a social engineering attack on its domain registrar, Namecheap, gave an attacker control of the across.to domain, which then served a malicious site. Across says it was alerted within 15 minutes and shut the site down; SEAL911 flagged the domain as phishing with major wallets, and Cloudflare marked it as at risk and later removed its DNS records. Across later reported that it had regained control of the domain. Across's smart contracts were not reported as affected. Affected - - Users who, on 10 November 2026, visited across.to and connected a wallet, approved a token, signed a message or Permit/Permit2 permit, or sent a transaction - - Networks named in Across's recovery guide: Ethereum, Base, Arbitrum, Ink, Plasma, BNB Chain (the guide warns the same malicious contracts may exist on other networks) - - Fixed: domain recovered and phishing site removed; approvals and unsubmitted permits already granted remain exploitable until revoked Impact According to Across's recovery guide, the malicious site asked users to sign token approvals and Permit2 permits that let attacker-controlled contracts move tokens out of their wallets, and some of these approvals are still open; any tokens arriving in an affected wallet can still be taken. Multiple users reported unauthorized withdrawals. The total amount stolen has not been disclosed. Across says all affected users will be made whole. Exploitation is confirmed. Recommended actions - - Revoke any approval or Permit2 allowance whose spender is one of the indicators below, on every network you use (type https://revoke.cash yourself; do not follow revoke links received by DM, reply or email). - - If you signed anything on across.to on 10 November, move remaining assets to a new wallet: signed but unsubmitted permits are not visible and cannot be revoked. - - If you cannot revoke immediately, move affected tokens out of the wallet. - - Wallets, dapps and exchanges: block the spender and receiver addresses below. Never send funds to them. - - Report losses to Across through its official account; Across will not DM first or ask for a seed phrase. Indicators The spender (drainer) contracts and attacker receiving addresses below are copied verbatim from Across's recovery guide. 0xCERT observed that the listed spender contracts on Ethereum, Base, Arbitrum and BNB Chain carry identical bytecode, consistent with the guide's statement that they run the same malicious code. The legitimate across.to domain is not an indicator. Source & attribution This 0xCERT advisory summarises Across's disclosure (https://x.com/AcrossProtocol/status/2120278803318489362, initial warning https://x.com/AcrossProtocol/status/2120231513459433747) and Across's recovery guide (https://docs.google.com/document/d/1IW3_cSr9fANfxHSXgVnzQ89Bitqv00Xbk-8bhx3L3kM), corroborated by DefiLlama's hacks dataset and DeFi Prime's report (https://defiprime.com/across-domain-takeover). Details may change; refer to the original sources for the authoritative record. References - ---------- - - https://x.com/AcrossProtocol/status/2120278803318489362 - - https://docs.google.com/document/d/1IW3_cSr9fANfxHSXgVnzQ89Bitqv00Xbk-8bhx3L3kM - - https://x.com/AcrossProtocol/status/2120231513459433747 - - https://x.com/AcrossProtocol/status/2120278805084295328 - - https://defiprime.com/across-domain-takeover Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc Fingerprint: 5F94 3ED1 1E50 CF31 2128 C493 CCC7 D9EC 9415 723D -----BEGIN PGP SIGNATURE----- wrsEARYKAG0Fgmr0h1sJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp b25zLm9wZW5wZ3Bqcy5vcmfUXPxtEgHxQ/jcfAEF/eFI3AMOWYHc5+2BGb2C IPW/JxYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAAsJgD/YjA2ZV30Qn0ibFBe 6aZedCsQiFSKkY06Ev2UUTZm3HgA/jpL4jzOUAd8jHW8+L0uE1u4sPtgQHFd 3e55hAMjeMAE =JiEc -----END PGP SIGNATURE-----