You open the “official website” you normally use, and suddenly a page asks you to authorize something, saying you have to sign to continue—do you sign, or exit first?
This was more than just a fake URL. In the early hours of November 11 Beijing time, the official domain across.to of cross-chain protocol Across was hijacked. The attacker socially engineered Namecheap, the domain registrar, to gain control of the real domain, then changed the official site into a phishing page that tricked users into signing fake token approvals. The team said it received an alert and began taking the site offline within about 15 minutes. Security response group SEAL911 flagged the site as phishing to major wallets, and Cloudflare subsequently removed the DNS records. Across has not disclosed the total losses or number of people affected; third-party security platform GoPlus estimates user losses at around $350,000. On the morning of November 11 Beijing time, Across announced it had regained control of the domain and restored its systems, and said affected users would be compensated. A full postmortem will be published later.
Remember these red flags: ① A familiar “official website” suddenly asks you to authorize or sign something. ② Your wallet or browser displays a phishing warning. ③ An official account tells you not to visit the site or sign anything for now. The key point: A domain can look exactly the same, but that doesn’t mean the page is still under the project’s control—a real official site can point to a phishing page after the registrar is socially engineered.
Think “if the URL is correct, it must be safe”? In fact, this time the official domain itself was changed. Three things to do tonight:
1) If a page suddenly asks you to authorize or sign something, exit first. Don’t sign.
2) Trust official accounts you already follow or notifications within the app. Don’t take the page’s own word that “this is official.”
3) If you’ve already signed: revoke suspicious approvals in your wallet. If anything seems wrong, create a new wallet on a clean device and transfer your assets.
This is not Binance being hacked again, and it’s not a request to install some “official recovery package.” The official website of any project could face the same kind of risk.
Which worries you more: A) opening a familiar official website and being asked to authorize something, or B) signing without thinking because “the domain is real”? Pick one in the comments (don’t post your recovery phrase or verification code).
(For educational purposes only; not investment advice. I do not trade or make calls. This summary is based on Across’s official statements from 11/10–11/11 and public reporting by The Block, Cointelegraph, and others. The estimated loss of around $350,000 is from GoPlus, a third party; refer to Across’s upcoming postmortem for the official account. This content was generated with AI assistance and edited by a human.)
$BNB $BTC
#加密安全 #防诈骗 #Web3Education
This was more than just a fake URL. In the early hours of November 11 Beijing time, the official domain across.to of cross-chain protocol Across was hijacked. The attacker socially engineered Namecheap, the domain registrar, to gain control of the real domain, then changed the official site into a phishing page that tricked users into signing fake token approvals. The team said it received an alert and began taking the site offline within about 15 minutes. Security response group SEAL911 flagged the site as phishing to major wallets, and Cloudflare subsequently removed the DNS records. Across has not disclosed the total losses or number of people affected; third-party security platform GoPlus estimates user losses at around $350,000. On the morning of November 11 Beijing time, Across announced it had regained control of the domain and restored its systems, and said affected users would be compensated. A full postmortem will be published later.
Remember these red flags: ① A familiar “official website” suddenly asks you to authorize or sign something. ② Your wallet or browser displays a phishing warning. ③ An official account tells you not to visit the site or sign anything for now. The key point: A domain can look exactly the same, but that doesn’t mean the page is still under the project’s control—a real official site can point to a phishing page after the registrar is socially engineered.
Think “if the URL is correct, it must be safe”? In fact, this time the official domain itself was changed. Three things to do tonight:
1) If a page suddenly asks you to authorize or sign something, exit first. Don’t sign.
2) Trust official accounts you already follow or notifications within the app. Don’t take the page’s own word that “this is official.”
3) If you’ve already signed: revoke suspicious approvals in your wallet. If anything seems wrong, create a new wallet on a clean device and transfer your assets.
This is not Binance being hacked again, and it’s not a request to install some “official recovery package.” The official website of any project could face the same kind of risk.
Which worries you more: A) opening a familiar official website and being asked to authorize something, or B) signing without thinking because “the domain is real”? Pick one in the comments (don’t post your recovery phrase or verification code).
(For educational purposes only; not investment advice. I do not trade or make calls. This summary is based on Across’s official statements from 11/10–11/11 and public reporting by The Block, Cointelegraph, and others. The estimated loss of around $350,000 is from GoPlus, a third party; refer to Across’s upcoming postmortem for the official account. This content was generated with AI assistance and edited by a human.)
$BNB $BTC
#加密安全 #防诈骗 #Web3Education
