【Security Alert】Cross-chain protocol Across’s official website domain has been hijacked; frontend and API suspended
At approximately 02:45 Beijing time, attackers used a social engineering attack targeting domain registrar Namecheap to seize control of Across’s official website domain and put up a phishing page. The team received an alert within 15 minutes and urgently took the website offline. SEAL911 coordinated with major wallets to flag the domain as a phishing site, and Cloudflare subsequently removed its DNS records. The phishing page is now inaccessible.
Who may be affected?
1. Users who visited the official website before the phishing page was fully blocked: at risk
2. Users who visited the official website before the attack, or used the protocol only via the API or third-party integrations: unaffected
Across has pledged to fully reimburse affected users. If you may have been affected, connect the wallet you were using at the time to Revoke.cash and revoke all approvals granted that day.
The key point about this incident is that it was not the smart contract that was compromised, but a social engineering attack at the domain registration level. No private keys were lost, but a single phishing signature could have handed over authorization to users’ assets. Namecheap has yet to respond. The frontend and API will remain suspended until the domain’s security is confirmed, and the team will publish a full postmortem later.
The lesson is clear: if a DApp behaves unexpectedly, check official channels for announcements first and don’t rush to sign anything. Regularly clearing unnecessary token approvals is one of the simplest ways to protect yourself.
#Web3安全 #钓鱼攻击 #Cross-chain protocol
At approximately 02:45 Beijing time, attackers used a social engineering attack targeting domain registrar Namecheap to seize control of Across’s official website domain and put up a phishing page. The team received an alert within 15 minutes and urgently took the website offline. SEAL911 coordinated with major wallets to flag the domain as a phishing site, and Cloudflare subsequently removed its DNS records. The phishing page is now inaccessible.
Who may be affected?
1. Users who visited the official website before the phishing page was fully blocked: at risk
2. Users who visited the official website before the attack, or used the protocol only via the API or third-party integrations: unaffected
Across has pledged to fully reimburse affected users. If you may have been affected, connect the wallet you were using at the time to Revoke.cash and revoke all approvals granted that day.
The key point about this incident is that it was not the smart contract that was compromised, but a social engineering attack at the domain registration level. No private keys were lost, but a single phishing signature could have handed over authorization to users’ assets. Namecheap has yet to respond. The frontend and API will remain suspended until the domain’s security is confirmed, and the team will publish a full postmortem later.
The lesson is clear: if a DApp behaves unexpectedly, check official channels for announcements first and don’t rush to sign anything. Regularly clearing unnecessary token approvals is one of the simplest ways to protect yourself.
#Web3安全 #钓鱼攻击 #Cross-chain protocol