One signature, $300,000 gone
The official website domain of cross-chain bridge Across was hijacked in the early hours of November 11, Beijing time. The fake website was up for about three hours, and according to estimates from several security teams, users lost a total of roughly $350,000 to $416,000.
At around 2:45 a.m., someone socially engineered Across’s domain registrar, gained control of the domain, and replaced the official website with a phishing page. The bridge’s contracts continued to operate normally; the website was what got compromised.
Users were still visiting the familiar URL, and the page asked them to sign what looked like a routine authorization. Once signed, the attackers could directly transfer coins out of their wallets. The first theft occurred about 18 minutes after the domain was hijacked.
By 3:05 a.m., the official team had issued a warning telling people not to visit the site or connect their wallets. Yet the biggest loss happened more than an hour later: one wallet signed just once, and over 140 ETH held in Aave was drained in several transactions, worth about $300,000 at the time.
Each stolen amount was split between two addresses in a 2:8 ratio. The funds were then moved across six chains and converted to ETH, before being broken up and transferred separately as BTC, SOL, and Monero-related tokens.
Across regained control of the domain after 9 a.m. and promised to reimburse all affected users. A full postmortem has yet to be published.
My takeaway: even if you enter the correct URL, you could still end up on a fake website. Take an extra look at the authorization before signing, and revoke approvals you no longer need.
If you’re new to crypto, it’s best to observe more and trade less. If you buy crypto, stick to $BTC .
The official website domain of cross-chain bridge Across was hijacked in the early hours of November 11, Beijing time. The fake website was up for about three hours, and according to estimates from several security teams, users lost a total of roughly $350,000 to $416,000.
At around 2:45 a.m., someone socially engineered Across’s domain registrar, gained control of the domain, and replaced the official website with a phishing page. The bridge’s contracts continued to operate normally; the website was what got compromised.
Users were still visiting the familiar URL, and the page asked them to sign what looked like a routine authorization. Once signed, the attackers could directly transfer coins out of their wallets. The first theft occurred about 18 minutes after the domain was hijacked.
By 3:05 a.m., the official team had issued a warning telling people not to visit the site or connect their wallets. Yet the biggest loss happened more than an hour later: one wallet signed just once, and over 140 ETH held in Aave was drained in several transactions, worth about $300,000 at the time.
Each stolen amount was split between two addresses in a 2:8 ratio. The funds were then moved across six chains and converted to ETH, before being broken up and transferred separately as BTC, SOL, and Monero-related tokens.
Across regained control of the domain after 9 a.m. and promised to reimburse all affected users. A full postmortem has yet to be published.
My takeaway: even if you enter the correct URL, you could still end up on a fake website. Take an extra look at the authorization before signing, and revoke approvals you no longer need.
If you’re new to crypto, it’s best to observe more and trade less. If you buy crypto, stick to $BTC .
