Across Protocol said it has regained control of its website after attackers took over its domain on Tuesday and replaced the site with a phishing page. The protocol said the incident stemmed from a social engineering attack targeting domain registrar Namecheap rather than a compromise of Across’s broader systems.

The team said the across.to domain is now back under its control with assistance from Namecheap founder Richard Kirkendall, and that services are operating normally again. Across also said users affected by the incident will be made whole and that it plans to publish a full post-mortem in the coming days.

How the incident unfolded

According to Across, the attacker gained control of its domain at about 18:45 UTC after a social engineering attack on Namecheap. Once control of the domain changed hands, the legitimate website was replaced with a phishing page.

Across said it was alerted within 15 minutes and moved to shut the website down immediately. That response was aimed at limiting exposure while the team worked to recover control of the domain and prevent additional users from interacting with the malicious page.

Mitigation steps and recovery

The protocol said outside security partners also helped contain the incident. Security group SEAL911 worked to have the domain flagged as phishing by major wallets, while Cloudflare marked the site as at risk and later removed its DNS records.

Across said those steps helped disrupt access to the malicious website while the domain issue was being resolved. It later confirmed that the domain had been restored and that all systems were functioning normally again.

Who may have been affected

Across said some users who visited the domain before the phishing site was blocked may have been impacted. At the same time, the team said third-party integrations and API users were not affected by the attack.

The protocol did not provide a count of potentially affected users in its initial update. Its public statement instead focused on restoration of the website, continued normal operation of systems, and a commitment to compensate users who suffered harm.

Why the disruption drew attention

The website takeover hit one of the larger cross-chain bridge operators by trading activity. Across ranked third by 30-day transfer volume at the time of the report, having processed roughly $5.9 billion over that period.

That scale helps explain why the incident drew immediate scrutiny even though the issue centered on the project’s web domain. For users, the key unresolved question is the extent of any losses among those who reached the phishing page before it was taken offline.

Next expected update

Across said a fuller accounting of the incident is still to come. The team said it will release a post-mortem in the coming days, which is expected to clarify how the social engineering attack succeeded, what users were affected, and what changes may follow.

Until then, the confirmed facts are limited to the timeline described by the project: a domain takeover linked to Namecheap, a phishing page briefly replacing the official site, mitigation by security partners, restoration of control, and a promise to make affected users whole.

Source: cointelegraph.com