Domínio · Breach

[Single source] Across Protocol domain hijacked to host phishing site

Nov 10, 2026 · 1 min read

A social engineering attack against Namecheap let an attacker seize the Across Protocol domain and host a phishing site. The malicious site is offline, but the Across frontend and API remain unavailable. Potentially affected visitors should revoke the attacker's permissions and contact Across.

By HIFY Radar newsroom Updated 11/10/2026 09:11 PM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In 30 seconds

Alleged

The latest supplied update says Across Protocol attributed its domain takeover to social engineering against Namecheap. It says the phishing site is offline, while the Across frontend and API remain unavailable during recovery.

What happened

Alleged

The incident first surfaced as an unspecified domain problem. Users were warned not to open the app, connect wallets, sign transactions or approve permissions. A later post reported that an attacker had gained control of the domain and used it to host a phishing site.

Why it matters

Inferred

The warning focused on wallet connections, signatures and approvals, meaning visitors could have been prompted to authorize harmful actions while the phishing page was active. The supplied evidence does not establish how many people interacted with it.

What to do

Alleged

The reported guidance is to avoid the Across app until an all-clear is issued. Anyone who visited during the incident should review and revoke suspicious permissions and contact Across if they may have interacted with the phishing page.

Confirmed and still uncertain

Observed

The newer post says the malicious site is offline and recovery work continues. Neither supplied post identifies the attacker, gives the exposure window, counts affected visitors or documents whether funds were lost.

What people are saying

Observed

DarkWebInformer first relayed a broad safety warning, then reported that Across had confirmed a hijack tied to social engineering against Namecheap. No direct statement from Across or Namecheap is included in the supplied evidence.

Evolution

Alleged

The picture became more specific over time: an initial investigation and do-not-interact warning was followed roughly two hours later by a reported explanation involving registrar access, domain control and a phishing page that had since been taken offline.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

The reported attack path was social engineering against Namecheap that enabled control of the Across domain. That control was allegedly used to serve a phishing site, rather than being described as a compromise of the protocol itself.

Sources and evidence

Observed

The evidence consists of two posts from the same X account, one carrying the initial warning and one carrying the later attribution and status update. Because neither item is a direct Across or Namecheap publication, the cause, impact and recovery status remain second-hand claims in this report.