Across Reports Domain Restored After Attack And Urges Permission Revocations
Across says its systems are operational again after a domain attack; its recovery instructions also address wallet permissions granted during the incident.
Across said it had regained control of its domain and restored operations in an update at 01:16 UTC on 11th November, following a reported attack the previous evening. The project also promised compensation for affected users and a subsequent report on the incident.
The service supports transactions between blockchains. Its restoration announcement concerns the availability and control of its systems; a separate recovery notice addresses permissions that visitors may have granted through the affected website.
Across Describes The Domain Takeover
In its initial incident account, Across said it lost control of its domain at about 18:45 UTC on 10th November. It attributed the takeover to social engineering involving its registrar, Namecheap. That account of the cause is Across's statement, not a finding independently confirmed by the registrar.
Across said it learnt of the incident within 15 minutes and worked to have the malicious website taken down. Its initial notice said the website and the interface used by other software, or API, would remain offline until it could secure them. The subsequent update said all systems were operational.
The project said users accessing Across through its API or other applications were unaffected. That statement describes the incident's claimed impact; it does not mean the API remained available throughout the response.
Wallet Permissions Are A Separate Recovery Step
Across's recovery instructions asked potentially affected website visitors to revoke permissions on the wallet they used and contact the project through its official X account with transaction details. Its later notice warned about impersonators. Across promised to compensate affected users; the announcement does not establish completed payments.
For ERC-20 tokens, Revoke.cash's explanation of token approvals describes how a token contract records which addresses may spend a holder's tokens and the permitted amount. The ERC-20 standard defines that spending allowance and how it can be changed.
Those mechanics explain why regaining control of a domain does not, by itself, clear permissions recorded on a blockchain. They do not establish which permissions any Across visitor granted or the mechanism of any particular loss. Our wallet guide explains how an allowance can expose assets even when the holder's private key stays secret.
In a separate incident, Kintsu's wallet warning and website recovery notice addressed the same distinction.
