ChainThink reports that on November 11, according to an announcement from Across, the attacker gained control of the Across official website domain through a social engineering attack targeting the domain registrar Namecheap.
Within 15 minutes of the incident, Cross received an alert and took down the website; SEAL911 assisted major wallets in marking the domain as a phishing site, and Cloudflare subsequently removed the associated DNS records, rendering the phishing page currently inaccessible.
Some users who accessed the official website before the phishing page was fully blocked may be affected. Across stated that it will fully compensate affected users and recommends that users revoke the permissions granted that day on Revoke.cash using the wallet they connected at the time.
Users who accessed the official website before the attack, as well as those using the protocol via API or third-party integrations, were not affected. The Across frontend and API will remain suspended until the domain's security is confirmed.
The team has not yet received a response from Namecheap and will investigate the cause of the domain takeover, with a post-incident review to follow.