Across Protocol

<h2 id="header-0">Key Facts</h2>
<ul>
 <li>Across Protocol said a social engineering attack on its domain registrar, Namecheap, gave an attacker control of the across.to domain at about 18:45 UTC on Nov. 10.</li>
 <li>Some users who visited the site before it was blocked may have been affected, Across said, while no third-party integrations or API users were.</li>
 <li>Across said early on Nov. 11 that its domain and systems were fully restored, that affected users will be made whole and that a post-mortem will follow.</li>
</ul>
Across Protocol (<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/currencies/across-protocol/">ACX</a>) regained control of its across.to domain and restored its systems, after an attacker took over the domain through its registrar and served a phishing site, the cross-chain protocol said.
At about 18:45 UTC on Nov. 10, a social engineering attack on Namecheap, Across's domain registrar, gave the attacker control of the domain, Across said. It was alerted within 15 minutes and worked to take the site down.
"All affected users will be made whole. We'll share a full post-mortem in the coming days," Across said in an <a target="_blank" rel="noopener noreferrer nofollow" href="https://x.com/AcrossProtocol/status/2120324818385912082">X post</a> early on Wednesday UTC.<img src="https://academy-public.coinmarketcap.com/optimized-uploads/0203a0a9348f4331b9ec1e3ecbb049d2.png">
ACX edged lower over the 24 hours spanning Across's domain takeover and restoration. Source: <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/currencies/across-protocol/">CoinMarketCap</a>
<h2 id="header-1">Who Was Affected</h2>
Some users who visited across.to before Cloudflare fully blocked the site may have been affected, Across said in an <a target="_blank" rel="noopener noreferrer nofollow" href="https://x.com/AcrossProtocol/status/2120278803318489362">earlier post</a>. No third-party integrations or API users were affected, it said.
Across asked users who believe they were affected to send it transaction details and to revoke permissions granted to the attacker. It did not give a loss figure or the number of users involved.
SEAL 911 flagged the domain as a <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/phishing">phishing</a> site with major wallets, and Cloudflare marked it as at risk and later pulled its DNS records, Across said.
<h2 id="header-2">Registrar Response</h2>
In its earlier post, Across said Namecheap had been unresponsive and that, because its domain had been locked down with best-in-class security practices, the takeover "should not have been possible." It said its frontend and API would remain down until they could be properly secured.
In its later update, Across thanked Namecheap's founder for responding on X, helping it secure its account and opening an investigation. It said it will communicate only through official channels.
<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/social-engineering">Social engineering</a> remains a common attack route. In April, CertiK <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/article/certik-flags-deepfakes-and-phishing-as-top-2026-crypto-threats">flagged deepfakes and phishing</a> as top crypto threats, and Lazarus Group has <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/article/lazarus-group-uses-fake-meetings-to-hijack-crypto-firms">used fake meetings to hijack crypto firms</a>.
ACX traded at $0.0430, down 2.5% over 24 hours, according to CoinMarketCap data.
Read More:&nbsp;<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/article/loopscale-pauses-solana-lending-attack-campaign">Loopscale Pauses Solana Lending Protocol After Week-Long Attacks</a>

Across Regains Domain After Hijack, Vows to Make Affected Users Whole

Table of Contents

Other articles published on Nov 11, 2026

Join our free newsletter for daily crypto updates!