Across Domain Hijack Drains About $350,000: How To Check And Revoke Wallet Approvals

What Happened To Across?

Across said attackers gained control of across.to through a social engineering attack on Namecheap, the company where the domain is registered. With control of the domain, they pointed it at a phishing page that looked like the real Across app. The page asked visitors to sign token approvals and permits, which gave the attackers permission to pull tokens out of their wallets.

Across said it got an alert within 15 minutes and started working to take the site offline. SEAL 911, a volunteer crypto security response group, flagged the domain as phishing with major wallet providers, and Cloudflare marked it as at risk and later removed its DNS records, which made the fake site unreachable. Across also kept its own website and API down while it worked to recover the domain.

Across said in that post that Namecheap hadn't responded to its requests for help. On Nov. 11, Across said the domain was back under its control with help from Namecheap's founder and that all systems were working normally.

Save This Article

Email this article to yourself

We'll send you a link to "Across Domain Hijack Drains About $350,000: How To Check And Revoke Wallet Approvals" so you can read it later, plus The Weekly Ritual, our free newsletter. Unsubscribe anytime.

Email address

Email It To Me

Email me this article and sign me up for The Weekly Ritual. See our privacy policy.

How Much Was Stolen?

GoPlus, a blockchain security company, estimated about $350,000 in losses across six networks. Across hasn't confirmed that figure, disclosed its own estimate or said how many users were affected. DefiLlama's hacks database lists the incident as a front-end DNS hijack, with the amount not yet disclosed.

Funds held by the bridge itself weren't touched. Across said third-party integrations and API users weren't affected, because the attack only changed where the across.to web address pointed. The risk was limited to people who opened across.to during the hijack and signed something in their wallet.

That's a small theft by crypto standards. DefiLlama counted $8.78 billion lost in 341 hacks and exploits so far in 2026, led by Binance's $6.36 billion breach in October.

Will Across Pay Victims Back?

Across said all affected users will be made whole and promised a full post-mortem on how the attacker got control of the domain. It hasn't said yet how repayment will work, how much it will pay or when. Across told affected users to contact its official account with their wallet addresses and transaction hashes.

A pledge isn't a payout. We've added the incident to our crypto hacks tracker as "pending" and will change it once Across confirms that victims have been repaid. The tracker lists every major incident and whether customers got their money back.

Be careful with messages about refunds. Scammers often pose as support staff after a hack and ask for a seed phrase or a "verification" transaction. Across won't need either one to repay you, and no real company ever asks for a seed phrase.

How To Check And Revoke Wallet Approvals

An approval lets an app or contract move a specific token out of your wallet, often with no limit. Approvals stay active until you revoke them, so one you signed months ago can still be used today. Checking them takes a few minutes:

1. Open an approval checker. Revoke.cash, which Across pointed users to, and Etherscan's token approval checker both show every approval tied to your wallet address. Connect your wallet or paste the address, then select each network you use.
2. Look for anything you don't recognize. Pay special attention to approvals granted on Nov. 10, unlimited approvals and approvals for apps you no longer use.
3. Revoke what you don't need. Each revoke is an on-chain transaction, so you'll pay a small network fee in that network's gas token, such as ether on Ethereum.
4. Check Permit2 allowances too. Many apps use Uniswap's Permit2 contract. Revoke.cash lists Permit2 allowances separately from regular approvals.

Revoking can't reverse a theft that already happened, and it won't cancel every kind of signature. Some permits are signed off-chain and don't show up as approvals until the attacker uses them. If you signed anything on across.to on Nov. 10, the safest move is to send your remaining tokens to a new wallet with a new seed phrase, then revoke old approvals from the old wallet.

Why Domain Hijacks Keep Happening

A domain hijack gets around the protections that keep smart contracts safe. The bridge code can be audited and secure, but if attackers control the web address, they control what users see and what they're asked to sign. That's why "bookmark the real site," the usual phishing advice, didn't protect Across users this time. The bookmark pointed to the right address, and the address itself had been taken over.

Across isn't the only target. On Oct. 31, The Block reported that hackers hijacked about a dozen DeFi websites, all registered through Name.com, and stole about $138,000. This is also Across's second incident of 2026. In July, an attacker sent forged Solana deposits that cost Across's relayer about $4.5 million of its own money, according to DefiLlama, with no user funds lost.

What This Means For Your Money

Bridges and DeFi apps ask you to sign transactions that can move your tokens, and a hijacked website can make a malicious request look routine. A few habits limit the damage:

• Read what you sign. A bridge transfer should send a specific amount. A request for an unlimited approval or a permit for a token you aren't moving is a warning sign.
• Use a wallet that simulates transactions. Many wallets now show what a transaction will do before you sign, and some flag known phishing sites.
• Keep a separate wallet for DeFi. Hold savings in a hardware wallet you don't connect to apps, and keep only what you're using in the wallet you bridge with.
• Revoke approvals on a schedule. Checking once a month clears out permissions you've forgotten about.

Our page on how blockchain bridges work covers more ways to bridge safely, and our list of common crypto scams explains what to do if you lose funds.

FAQ

Was The Across Bridge Hacked?

No. The bridge's smart contracts and the funds they hold weren't exploited. Attackers hijacked the across.to web address and ran a phishing page, so only people who visited that site during the hijack and signed approvals or permits lost money.

Is It Safe To Use Across Now?

Across said it regained control of across.to on Nov. 11 and that all systems are working normally. Some browsers and wallets may still show a phishing warning for a while. Across hasn't published its post-mortem yet, so check its official accounts before you use the site.

I Used Across On Nov. 10. What Should I Do?

Check your approvals on Revoke.cash or Etherscan for every network you used, and revoke anything you don't recognize. If you signed a permit or approval on across.to that day, move your remaining tokens to a new wallet. If you lost funds, contact Across through its official account with your wallet address and transaction hashes.

Does Revoking An Approval Get My Money Back?

No. Revoking stops future transfers under that approval, but it can't reverse a transfer that already happened. Victims will need to rely on Across's pledge to repay affected users.