On 10 November 2026 Across said control of its domain, across.to, was taken at about 18:45 UTC. The project’s account, as Cointelegraph, The Block, and Coindaro quote it, is that the takeover was social engineering at its registrar, Namecheap, and that visitors were sent to a phishing page. Across says it was alerted within about 15 minutes and tried to take the site down. SEAL 911 flagged the domain with major wallets. Cloudflare later marked the domain at risk and removed the DNS records. This page did not open the posts. It will not list any contract, and it will not describe how to revoke an approval.
A domain is the front door of a website. What is a crypto bridge? is the product Across runs: software that releases assets on one network because of a message about another. The domain is not that software. A page that asks for a signature is not the bridge. Across says third-party integrations and people using its API were not affected.
What happened
Across says the domain was back under its control at about 01:16 UTC on 11 November. It attributes the help to Namecheap’s founder, Richard Kirkendall, as those outlets quote the project, and it says all systems are operating normally. It says all affected users will be made whole. A post-mortem is promised and is not out. Across has not published a loss total or a count of people. An outside estimate is not Across’s figure, and this page will not use one. A promise to make users whole is not a list of who has been paid. Some wallets may still show a warning on the domain. That warning is the wallet’s. It is not a second takeover.
The hours in between are the part that matters. From about 18:45 UTC on 10 November until about 01:16 UTC on 11 November, the address in the browser was not a reliable way to reach Across. A bookmark is a name. It is not a check that the page behind the name is the one you used last week. See What is a wallet signature?. Connect, approve, and send are different acts. A page that can ask for the second one while you think you are on the first is the costume.
Why it matters
If you opened across.to in that window, the question is what you signed on a page you did not mean to trust. If you did not open it, this page did not spend a wallet you hold. If you use Across through another application’s integration, or through the API, Across says that path was not the domain. See How do you keep crypto safe?. A recovery note that Across posts on its own channels is the place for any next step. This page will not copy a contract list, and it will not tell you which approval to revoke.
A domain hijack is not a bridge bug of the kind on zkLink’s halt or Initia’s halt. Those were the software that releases coins. This was the website in front of the software. Both can move money. They do not move it the same way, and Across has not said the bridge contracts themselves were rewritten.
What happens next
The post-mortem Across promised, which is not out. A loss total, if the project ever publishes one. Who, if anyone, has actually been paid under the promise to make users whole. Watch Across’s own channels. We will not treat a returned domain as every signature undone, and we will not treat an outside dollar estimate as Across’s figure.
Not a recommendation to bridge, revoke, or visit a domain. Not a finding that Namecheap’s other customers were hit. Not a list of contracts. The public account, as those outlets quote Across, is a domain taken, a domain returned, and a promise without a number.
