Across Protocol Domain Hijack: Web3 DNS Phishing
Across Protocol Domain Hijack: Web3 DNS Phishing
On November 10, 2026, decentralized bridge Across Protocol experienced a critical security incident when an attacker seized control of its primary web domain via a registrar-level social engineering attack on Namecheap. The Across Protocol domain hijack allowed threat actors to temporarily redirect legitimate protocol visitors to a spoofed interface equipped with a malicious wallet drainer. While the underlying cross-chain smart contracts remained untouched, the breach underscores the expanding threat surface targeting Web3 frontends and off-chain infrastructure.
Key Takeaways
Registrar-Level Compromise: Attackers bypassed technical infrastructure by executing social engineering against customer support at domain registrar Namecheap, transferring domain pointer control without compromising developer keys.
Smart Contracts Unaffected: Across Protocol's core bridge liquidity pools and cross-chain messaging contracts were not compromised; all user losses occurred purely via client-side transaction signing on the rogue frontend.
Rapid Incident Response: The protocol team detected anomalous routing within 15 minutes and partnered with the Security Alliance (SEAL 911) to coordinate swift takedown and domain reclamation.
Full User Restitution: Across Protocol leadership confirmed that all verified victims who interacted with the drainer during the hijacking window will be reimbursed in full.
Web2 Dependencies Remain Fragile: The incident reiterates that decentralization on-chain cannot compensate for centralized Web2 dependencies such as DNS registrars without robust registry locks and decentralized hosting fallbacks.
What Happened: The Across Protocol Frontend Takeover
Across Protocol functions as one of decentralized finance's most popular cross-chain bridging networks, facilitating low-latency, capital-efficient transfers across Ethereum, Layer 2 rollups, and EVM-compatible ecosystems. At approximately 18:45 UTC on November 10, 2026, security monitoring systems and community members observed that users navigating to the official Across website were encountering unexpected wallet signature prompts.
Rather than connecting to the standard liquidity bridge interface, visitors were greeted by a cloned frontend created to harvest token approvals through automated drainer payloads. Upon closer inspection, Across Protocol administrators realized that the official DNS records had been manipulated directly at Namecheap, their domain registrar.
The threat actor did not compromise internal Across Protocol servers, GitHub repositories, or continuous deployment pipelines. Instead, the attacker targeted Namecheap's support personnel, utilizing impersonation techniques and fraudulent authorization credentials to redirect nameservers to malicious hosting servers under the attacker's administrative control.
Technical Analysis: DNS Spoofing and Web3 Drainers
In traditional cybersecurity, DNS hijacking is a familiar vector used for credential harvesting and phishing. In decentralized finance, however, hijacking a protocol's domain nameserver represents a direct conduit to draining self-custody wallets because end-users fundamentally rely on HTTPS browser validation as a proxy for protocol authenticity.
How the Exploit Worked
The incident followed a coordinated multi-phase operational path that exploited human vulnerabilities in off-chain customer support workflows:
Targeted Social Engineering: The attacker targeted Namecheap customer support channels, presenting forged documentation or utilizing account recovery mechanisms to claim authorized administrative ownership over the Across Protocol domain.
Nameserver Record Alteration: Once support agents granted administrative updates, the attacker replaced Across Protocol's legitimate authoritative nameservers with custom DNS records pointing to an attacker-controlled content delivery network (CDN).
SSL Certificate Provisioning: Because the attacker maintained active control of the authoritative DNS records, they quickly generated valid Let's Encrypt TLS/SSL certificates, eliminating browser-level security warnings for connecting users.
Malicious Frontend Injection: The attacker deployed a cloned version of Across Protocol's decentralized application (dApp). When users initiated bridge transfers or attempted wallet connections, the frontend triggered aggressive permit signatures (such as EIP-2612) and unbounded ERC-20 approval requests to siphon funds into an exploit address.
Containment and Mitigation: Across Protocol core contributors mobilized within 15 minutes of initial alert indicators, enlisting SEAL 911 emergency responders to issue blacklists on major Web3 wallet extensions, revoke malicious cloud routing, and regain registrar control.
This attack exemplifies why relying solely on standard off-the-shelf domain registration without institutional defense mechanisms leaves Web3 applications exposed to severe operational security breakdowns.
Impact and Implications for Web3 Infrastructure
The Across Protocol domain hijack highlights a structural dichotomy in modern decentralized systems: while smart contracts undergo rigorous formal verification and smart contract audits, the client-facing presentation layer remains tethered to legacy Web2 domain registries and single-factor customer support workflows.
Encouragingly, Across Protocol's rapid mobilization prevented a catastrophic drain event. While dozens of active users who executed transactions during the window fell victim to the drainer, Across confirmed that all affected community members would be made whole via treasury compensation. Nonetheless, the reputational and operational friction caused by DNS manipulation poses significant systemic risks to the broader ecosystem.
When high-volume bridges and automated market makers suffer domain takeovers, downstream aggregators, wallets, and automated solvers can inadvertently index poisoned links or present compromised interfaces to retail traders. True blockchain security requires an end-to-end posture that protects off-chain governance and Web2 hosting with the same rigor applied to consensus algorithms.
How to Protect Your Protocol Against Frontend Hijacking
Decentralized protocols must adopt comprehensive defense-in-depth frameworks to insulate their web applications from third-party registrar lapses and social engineering:
Enforce Registry Locks: Enterprise protocols should mandate top-tier Registry Lock services (at Verisign or registry operator level). A Registry Lock prohibits any DNS modification, transfer, or nameserver update without multi-party out-of-band identity verification involving multiple designated protocol executives.
Implement DNSSEC: Domain Name System Security Extensions (DNSSEC) protect networks against cache poisoning and unauthorized redirection by cryptographically authenticating DNS lookup responses.
Decentralized Frontend Hosting (IPFS/Arweave): Teams should provide canonical, immutable frontend versions hosted on decentralized storage networks like IPFS or Arweave, coupled with Ethereum Name Service (ENS) domains that cannot be seized via registrar social engineering.
Continuous Off-Chain Fuzzing and Monitoring: Incorporating automated DNS record drift monitoring and fuzz testing across client-side dependencies alerts incident teams the second an unauthorized nameserver or record switch takes place.
Wallet Simulation Integration: Protocols must encourage users to leverage transaction simulation tools and hardware signers that inspect approval calldata, alerting users when a signature grants unauthorized token allowances to unrecognized contracts.
Conclusion: Bridging the Gap Between On-Chain and Off-Chain Security
The Across Protocol domain hijack serves as a potent reminder that decentralized protocols cannot neglect Web2 operational security. Attackers increasingly recognize that compromising customer support personnel at domain registrars is significantly easier than breaking mathematically verified smart contracts. To safeguard users, DeFi protocols must reinforce their DNS infrastructure, utilize institutional registry locks, and implement decentralized frontend redundancy.
At FYEO, we provide end-to-end security solutions ranging from comprehensive smart contract audits to full-spectrum threat monitoring and operational risk assessments. Protect your protocol against both on-chain exploits and off-chain supply chain threats by securing your stack with FYEO's battle-tested security engineers today.