Across's contracts were never touched, yet users still got drained.
Three questions about the $ACX bridge incident:
Q: Was the bridge hacked?
Not in the smart-contract sense. At about 18:45 UTC on Nov 10, an attacker used social engineering on the registrar Namecheap, took over across.to and swapped in a phishing page. Across says it was alerted within 15 minutes.
Q: How much was lost?
GoPlus estimates roughly $350,000 across six chains, including Ethereum, Base and BNB Chain. Across hasn't confirmed a figure but says affected users "will be made whole," with a post-mortem to come.
Q: What should bridge users take from it?
My view: the weak link was the front door, not the vault. Any Permit or approval signature deserves a second look, and wallets that touched the site on Nov 10 should review approvals.
Which hurts DeFi trust more: a contract bug or a hijacked domain? $ETH bridging runs through these sites daily.
Sources: Cointelegraph, crypto.news. #DeFi #Security
Disclosure: Write to Earn may pay me a commission on cashtag trades.
Three questions about the $ACX bridge incident:
Q: Was the bridge hacked?
Not in the smart-contract sense. At about 18:45 UTC on Nov 10, an attacker used social engineering on the registrar Namecheap, took over across.to and swapped in a phishing page. Across says it was alerted within 15 minutes.
Q: How much was lost?
GoPlus estimates roughly $350,000 across six chains, including Ethereum, Base and BNB Chain. Across hasn't confirmed a figure but says affected users "will be made whole," with a post-mortem to come.
Q: What should bridge users take from it?
My view: the weak link was the front door, not the vault. Any Permit or approval signature deserves a second look, and wallets that touched the site on Nov 10 should review approvals.
Which hurts DeFi trust more: a contract bug or a hijacked domain? $ETH bridging runs through these sites daily.
Sources: Cointelegraph, crypto.news. #DeFi #Security
Disclosure: Write to Earn may pay me a commission on cashtag trades.