Across Protocol takes back its website after a registrar social-engineering attack sent visitors to a phishing page, with GoPlus estimating nearly $350,000 stolen

Across Protocol, a cross-chain bridge, said an attacker took control of its website domain on Tuesday at about 18:45 UTC and redirected visitors to a phishing page that imitated the real site, crypto.news and CoinCentral reported. Across said it was a social-engineering attack aimed at the registrar Namecheap, not an exploit of the bridge's smart contracts.

Across said it was alerted within about 15 minutes and began shutting the site down. The security group SEAL911 helped flag the domain as phishing, and Cloudflare removed its DNS records. Across suspended its frontend and API while it regained control of the registrar account, and by Wednesday it said the domain was back and systems were running normally. It thanked Namecheap founder Richard Kirkendall for responding, helping secure the account and opening an investigation.

The security firm GoPlus estimated that nearly $350,000 was stolen across Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma, crypto.news reported. Across has not confirmed that figure or said how many users were affected. Some users reported their own losses, which CoinCentral said Cointelegraph had not independently verified. Across said affected users would be compensated and a full post-mortem would follow, and that API users and third-party integrations were not affected.