Across Protocol website hijack drains $305,000 from Aave user

Across Protocol restored its website on November 11, 2026, following a domain hijacking attack initiated via social engineering against registrar Namecheap on November 10. Attackers redirected visitors to a phishing site that drained user wallets across multiple blockchains using malicious token permits. Bitquery estimates overall losses reaching $401,900, with a single Aave depositor losing $305,000 in aWETH tokens after signing spending permissions. Across Protocol has pledged full reimbursement to affected users.

Hijack details and emergency response

• ▪Across Protocol regained control of its domain and fully restored its website systems on November 11, 2026, following a domain hijacking attack that began on November 10, 2026
• ▪Emergency response group SEAL911 and web infrastructure provider Cloudflare took across.to offline by flagging it as a phishing site and removing its DNS records during the November 10, 2026 incident
• ▪Across Protocol thanked Namecheap founder Richard Kirkendall for intervening on X to help secure the registrar account and open an investigation into the November 10, 2026 takeover
• ▪Attackers gained unauthorized control of Across Protocol's domain through a social engineering attack targeting domain registrar Namecheap

Financial losses and security estimates

• ▪Bitquery's November 12, 2026 update estimated $401,900 in total crypto losses across nine wallets on five blockchains resulting from the Across Protocol website hijack
• ▪Bitquery traced the first stolen Aave deposit token transaction on November 10, 2026 to an 80/20 split between the attacker's wallet (115.23 aWETH) and a drainer fee wallet (28.81 aWETH)
• ▪Bitquery estimated that an Aave depositor lost about $305,000 in aWETH tokens during the November 10, 2026 Across Protocol website hijack after signing a permit on the compromised interface that exposed a separate lending position
• ▪Security firm GoPlus estimated that attackers stole approximately $350,000 from cryptocurrency wallets across Ethereum, Arbitrum, Base, BNB Chain, Ink, and Plasma using malicious token approvals and permit signatures

User safety guidance and compensation

• ▪Across Protocol pledged to make all users affected by the November 10, 2026 phishing attack whole
• ▪Across Protocol stated that its API users, third-party integrations, and users who accessed the frontend prior to November 10, 2026 were unaffected by the domain takeover
• ▪Across Protocol advised users who connected wallets to the fraudulent frontend on November 10, 2026 to inspect and revoke granted permissions using Revoke.cash

Wider crypto market exploit context

• ▪Security firm Blockaid identified at least 12 DeFi websites serving the Step Drainer phishing toolkit during a separate wave of DNS hijackings on October 31, 2026
• ▪Blockchain security firm Blockaid reported that global crypto losses from hacks and exploits surpassed $1.1 billion in the first half of 2026, while DefiLlama separately recorded $8.78 billion lost across 341 incidents year-to-date