Pinned post
Across is fully restored, and all systems are operational.
across.to is back under our control, and all Across systems are working normally.
Thank you to the Namecheap founder, @synth for responding on X, helping us secure our account and opening an investigation into how this happened.
All affected users will be made whole. We’ll share a full post-mortem in the coming days.
While the domain was compromised, @SEAL_911 helped us get across.to flagged as phishing. If you still see a warning in your wallet or browser, it should clear soon.
We will only communicate through official Across channels. Don’t trust messages, links or DMs from any other source claiming to be from the team.
across.to is back under our control, and all Across systems are working normally.
Thank you to the Namecheap founder, @synth for responding on X, helping us secure our account and opening an investigation into how this happened.
All affected users will be made whole. We’ll share a full post-mortem in the coming days.
While the domain was compromised, @SEAL_911 helped us get across.to flagged as phishing. If you still see a warning in your wallet or browser, it should clear soon.
We will only communicate through official Across channels. Don’t trust messages, links or DMs from any other source claiming to be from the team.
across.to Across Across is the bridge that just works. Bridge and swap tokens between any supported chain in seconds. The Across domain is currently down while we secure it against an attack from earlier today.View quoted post on X
At ~18:45 UTC, a social engineering attack on @Namecheap (our domain registrar) gave a bad actor control of the Across domain.
Within 15 minutes of this attack, we were alerted and immediately worked to shut the site down. SEAL911 marked across.(to) as a phishing site with major wallets, and Cloudflare worked with us to mark the domain as at risk, and later pulled the site’s DNS records.
At the time of this post, Across.(to) is fully down, and the phishing site is no longer available.
In the brief period before Cloudflare fully blocked the malware site, some users who visited across.(to) may have been affected. No third-party integrations or API users were affected. Users who believe they were affected should DM us with transaction details and revoke attacker permissions (see next tweet for details).
Despite our best efforts, @Namecheap has been unresponsive, and we have not been able to properly secure the domain to bring Across’s services back up. Across’s frontend and API will remain down until we can properly secure them. We will always put user safety first.
Across’s domain was fully locked down with best-in-class security practices; this unauthorized takeover should not have been possible. We will be investigating this deeply and will provide a post-mortem on how this domain takeover was possible once we have more information.