---
title: Across bridge's domain hijacked through a social-engineering attack on its registrar, Namecheap; the site served a phishing page | ctxsec
url: https://ctxsec.com/items/across-protocol-domain-hijack-namecheap-social-engineering-phishing-frontend-nov-10
description: "Across, the cross-chain bridge used for Uniswap's cross-chain swaps, says that at about 18:45 UTC on Nov 10 (1:45 PM ET) a social-engineering attack on its registrar Namecheap gave an attacker control of the across.to domain. Across says it was alerted within 15 minutes; SEAL911 got wallets to flag the domain as phishing and Cloudflare later pulled its DNS records. Some users who visited the site before it was blocked may have been affected; Across says third-party integrations and API users were not. Its frontend and API stay down until it can secure the domain, and it says Namecheap has been unresponsive."
status: "official (Across statements on its verified X account, Nov 10, 2026); loss totals circulating in crypto media are not confirmed by Across"
published: 2026-11-10
---

> Across, the cross-chain bridge used for Uniswap's cross-chain swaps, says that at about 18:45 UTC on Nov 10 (1:45 PM ET) a social-engineering attack on its registrar Namecheap gave an attacker control of the across.to domain. Across says it was alerted within 15 minutes; SEAL911 got wallets to flag the domain as phishing and Cloudflare later pulled its DNS records. Some users who visited the site before it was blocked may have been affected; Across says third-party integrations and API users were not. Its frontend and API stay down until it can secure the domain, and it says Namecheap has been unresponsive.

[← Cybersecurity News](/news) · [markdown](/items/across-protocol-domain-hijack-namecheap-social-engineering-phishing-frontend-nov-10.md)

official (Across statements on its verified X account, Nov 10, 2026); loss totals circulating in crypto media are not confirmed by Across

2026-11-10

### Across bridge's domain hijacked through a social-engineering attack on its registrar, Namecheap; the site served a phishing page

- **Not a contract exploit:** the attacker controlled the website, not the bridge's contracts. The danger was signing approvals or transactions on the fake site.
- **If you used across.to on Nov 10:** Across asks affected users to DM transaction details and to revoke the attacker's token approvals; disconnecting a wallet does not revoke approvals already signed.
- **Defender takeaway:** registrar accounts are part of your attack surface. Registry lock, registrar-side MFA and change alerts, and DNS monitoring matter as much as contract audits. Across says it will publish a post-mortem on how the takeover was possible.

Sources: [Across on X: domain takeover statement (Nov 10, 2026)](https://x.com/AcrossProtocol/status/2120278803318489362) · [Across on X: initial alert (Nov 10, 2026)](https://x.com/AcrossProtocol/status/2120231513459433747)