Across, a popular bridge for moving crypto between blockchains, lost control of its website on Tuesday, November 10, 2026. An attacker took over its web address and replaced the real site with a fake copy that tricked visitors into signing permissions. Those permissions let the attacker empty their wallets. Across says all affected users will be made whole.
Key facts
- When: the takeover began around 18:45 GMT (1:45 p.m. ET) on November 10. Across says it was alerted within about 15 minutes, warned users not to open the app and started shutting the site down.
- How: Across says the attacker used social engineering against the company that registers its web address (its domain registrar, Namecheap), and so was able to point the address to a phishing page. The bridge’s smart contracts were not hacked.
- How wallets were emptied: the fake site asked visitors to approve tokens or sign “permits”. Once signed, these let the attacker’s contracts move tokens out of the wallet.
- Losses: security firm GoPlus estimated close to $350,000 stolen across six blockchains, including Ethereum, Arbitrum, Base and BNB Chain. Across has not confirmed a total or the number of victims.
- Who was not affected: people who used Across before the attack, and those who use it through its API or through other apps built on top of it.
- Back online: after security groups and major wallets flagged the address as phishing, Across regained control of it. Early on November 11 (GMT), the team said the site was fully restored and all systems were working.
What users should do
Across’s advice to anyone who connected a wallet or signed anything on its site on November 10:
- Revoke permissions given that day, using a tool such as Revoke.cash, typed into the browser by hand (scammers copy these sites too).
- If you signed a permit and are not sure it is gone, move the remaining coins to a new wallet. Revoking stops future theft but does not bring back coins already taken.
- Across says it will never message first, and never ask for a seed phrase or private key.
Across asks victims to contact it directly with their wallet address and transaction details. It has not yet said when or how repayments will be made, and it promised a full report on the attack in the coming days.
Why it matters
The code holding users’ money was never broken. The weak point was the web address, run by an outside company, which the attacker took over by fooling people rather than computers. A familiar website can be swapped for a fake one without warning, so the usual rule applies: read what a wallet asks you to sign, be wary of unexpected approval requests, and check your open approvals from time to time.
This article is for information only and is not financial advice.
