Across Protocol Recovers Website After Hackers Seize Control of Domain

The Across Protocol website has been revived after it suffered a domain hijack on November 10, which led to users being taken to a phishing website. According to cybersecurity experts, about $350,000 (roughly Rs. 3.2 crore) has been stolen from crypto wallets. In an update on Wednesday, the cross-chain bridge stated that their domain had been taken back under their control and that all systems were working fine. The hackers' attack was due to social engineering through the domain registrar Namecheap, according to the team.

Social Engineering Attack on Domain Registrar Triggered the Phishing Incident 

“All affected users will be made whole. We'll share a full post-mortem in the coming days,” Across stated. According to GoPlus Security firm, the phishing scam has impacted wallets on Ethereum, Arbitrum, Base, BNB Chain, and Ink and Plasma. Across has not disclosed the total amount lost by them or the total number of impacted users. 

The incident took place around 18:45 UTC on November 10, when an intruder succeeded in gaining access to the Across domain after a social engineering attack as was stated by the protocol on Namecheap. The attack involved no hacking into the smart contracts of the bridge. The hacker just manipulated the domain settings of the site and steered traffic toward the fake page.

According to the report issued by Across, the company received an alert within 15 minutes and started working right away to block the malicious site. The phishing response team, SEAL911, assisted in marking across.to as a fraudulent site carrying cryptocurrency wallets. This was followed by Cloudflare classifying the website as malicious and deleting its DNS records to keep visitors off the site. These actions occurred as the protocol tried to regain control of its domain registrar account. Across paused both its frontend and API services temporarily.

According to GoPlus, the individuals who were exposed to the phishing page may have been convinced to sign EIP-2612 permits, Permit2 authorisations, or token approvals. These permissions would enable the approved spender to move the tokens out of the wallet without having to approve each transaction thereafter. In certain scenarios, the victims may have been convinced to transfer the cryptocurrency directly to the address owned by the attacker.

The loss of $350,000 (roughly Rs. 3.2 crore) is stated for various blockchain platforms, even though Across hasn't yet verified the number on its own. The company stated that users who visited its website prior to the incident were not harmed. The company further added that third-party integration and API users were unaffected by the domain breach.