Across Regains Control of Website Domain and Pledges Full Compensation

Cross-chain protocol Across said on November 11 that it had regained control of its website domain and restored normal operations following a security incident. The team also pledged to fully compensate affected users and said it would publish a detailed post-incident report in the coming days.

The incident highlights a risk that extends beyond smart contracts: even when a decentralized protocol’s infrastructure is functioning, the website users rely on to access it can become an attack surface.

How the Domain Was Compromised

According to Across, the attacker used social engineering against its domain registrar, Namecheap, to gain control of the domain. Social engineering attacks target people and organizational processes rather than relying solely on software vulnerabilities.

During the period of unauthorized control, security response team SEAL 911 helped flag the domain as a phishing site. That warning could help prevent further exposure, but it also meant that some wallets and browsers might continue displaying alerts after Across recovered the domain. The team said it expected those warnings to clear soon.

Across’s statement concerns the website domain; it does not establish that the protocol’s smart contracts were compromised. That distinction matters when assessing the incident, although a deceptive website can still expose users to harmful transactions.

What Affected Users Should Watch For

Across has committed to full compensation, but users should look to its verified communication channels for details on eligibility and the claims process once those are published. The forthcoming post-incident analysis may also provide a clearer picture of the attack and its impact.

In the meantime, users who interacted with the site during the incident can take several precautions:

• Review recent transactions and token approvals. Look for activity or permissions you do not recognize. Revoke suspicious approvals using a trusted tool, taking care to verify the tool’s own address.
• Be cautious of compensation messages. Attackers may exploit public incidents with fake refund sites or support accounts. Do not enter a recovery phrase to claim a payment.
• Inspect wallet prompts before signing. A request to approve token spending or sign a transaction deserves the same scrutiny as a request to transfer funds.
• Take browser and wallet warnings seriously. Security labels may persist after a domain is recovered, but an unexpected warning is still a reason to pause and verify the situation through independent channels.

Users who believe they may have exposed a recovery phrase or private key should treat the associated wallet as compromised. Moving remaining assets to a newly created wallet may help limit further losses, but users should carefully verify the destination address and seek trusted assistance if needed.

Why Domain Security Matters for DeFi

Cross-chain services depend on more than on-chain code. Users also interact with websites, domain name infrastructure, wallet interfaces and third-party services. A weakness in any of these layers can undermine the experience of using an otherwise available protocol.

Hardware wallets can help protect private keys from being directly exposed to a website, but they cannot determine whether every transaction a user approves is safe. Reviewing the destination, token permissions and transaction details remains essential—especially after a reported security incident.

The Across case is a reminder that recovery has several parts: restoring control of the website, communicating clearly with users, resolving security warnings and explaining how affected users will be compensated. Until the post-incident report is available, users should avoid assuming the full scope or mechanism of the attack.