Across Restores Domain After $350K Phishing Attack
By Abdelaziz Fathi
AI summary of the source article
Across Protocol regained control of its website after a domain hijacking led to an estimated $350,000 drained via phishing. Separately, decentralized exchange Arcus lost $2.23 million to a subaccount accounting flaw, covering the shortfall from company treasury funds.
Why it matters
The attack shows that "audited smart contracts do not eliminate frontend risk" and that "control of a legitimate domain can turn existing user trust into a wallet-draining mechanism without requiring attackers to compromise the underlying protocol."
Key facts
- Across Protocol's domain was hijacked via registrar Namecheap, directing users to a phishing site that drained an estimated $350,000 across six blockchains.
- Across regained control of the domain on November 11 and pledged to compensate affected users.
- Decentralized exchange Arcus covered a 2,234,391 USDG shortfall from its treasury after an attacker exploited an accounting bug in subaccount transfers.
Source excerpt · FinanceFeeds
Across Protocol has regained control of its website after attackers hijacked its domain through a social engineering attack targeting registrar Namecheap, redirecting users to a phishing page that security researchers estimate drained roughly $350,000 across six blockchain networks. The cross-chain protocol said the attack began at around 18:45 UTC on November 10. Across received an alert within a…