Across bridge's domain hijacked through a social-engineering attack on its registrar, Namecheap; the site served a phishing page
- Not a contract exploit: the attacker controlled the website, not the bridge's contracts. The danger was signing approvals or transactions on the fake site.
- If you used across.to on Nov 10: Across asks affected users to DM transaction details and to revoke the attacker's token approvals; disconnecting a wallet does not revoke approvals already signed.
- Defender takeaway: registrar accounts are part of your attack surface. Registry lock, registrar-side MFA and change alerts, and DNS monitoring matter as much as contract audits. Across says it will publish a post-mortem on how the takeover was possible.
Sources: Across on X: domain takeover statement (Nov 10, 2026) · Across on X: initial alert (Nov 10, 2026)