The cross-chain protocol said the attack began at around 18:45 UTC on November 10. Across received an alert within about 15 minutes and began trying to disable the compromised site, while security response group SEAL911 flagged the domain with major wallet providers and Cloudflare eventually removed its DNS records.
Across said on November 11 that the domain was back under its control with assistance from Namecheap founder Richard Kirkendall and that all systems were operating normally. The protocol has pledged to compensate affected users and plans to publish a full post-mortem.
How Did Attackers Drain Funds Without Hacking Across?
The incident did not involve a disclosed compromise of Across’s smart contracts. Instead, control of the legitimate across.to domain allowed attackers to replace the project’s frontend with a malicious site while visitors still believed they were interacting with Across.
Security platform GoPlus estimated losses at approximately $350,000 across Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma. Across has not independently confirmed that figure or disclosed how many users were affected.
The phishing interface attempted to persuade users to sign malicious token approvals and permit authorizations. Those signatures can give another address permission to transfer assets from a wallet without the victim approving each subsequent transaction.
Across said third-party integrations and API users were unaffected, limiting the known exposure to users who interacted with the compromised website during the attack window.
The method resembles other recent attacks in which criminals compromise trusted infrastructure rather than attempting to break wallet cryptography directly. FinanceFeeds recently reported how Coldcard’s official X account was used to distribute a phishing link, despite the wallet maker saying it had tightly restricted account access.
Investor Takeaway
The attack shows that audited smart contracts do not eliminate frontend risk. Control of a legitimate domain can turn existing user trust into a wallet-draining mechanism without requiring attackers to compromise the underlying protocol.
How Did Arcus Lose $2.23 Million From an Accounting Bug?
A separate incident at Arcus shows a different type of infrastructure risk. The decentralized exchange said an attacker withdrew 2,234,391 USDG after exploiting an accounting flaw in transfers between subaccounts.
The bug allowed the attacker to make one account record a balance larger than the funds actually held and then request withdrawals against the inflated figure. DefiLlama classifies the incident as a protocol-logic exploit involving a withdrawal flaw.
Arcus said the attacker attempted to withdraw another roughly $3 million, but the bridge’s withdrawal rate limit prevented those requests from being completed. The pending transactions were later reversed.
The exchange paused withdrawals during its response, patched the accounting issue, restricted the exploiter’s accounts and subsequently reopened withdrawals. Arcus Labs said it covered the entire $2.23 million shortfall from company treasury funds, leaving other customer balances, positions and orders unaffected.
Investor Takeaway
Arcus provides an example of a security control limiting losses after the underlying application logic has already failed. Its bridge rate limit prevented approximately $3 million of additional withdrawals, making withdrawal controls financially consequential rather than merely operational safeguards.
Why Are Security Failures Spreading Beyond Smart Contracts?
The incidents arrive during an unusually costly year for crypto security. DefiLlama’s latest data shows approximately $8.78 billion lost across 338 hacks and exploits in 2026 through November 10, compared with 322 incidents and $8.73 billion when FinanceFeeds reviewed the year’s losses on October 30.
The $6.36 billion Binance breach remains responsible for most of that value. Binance later said the attack began with social engineering and compromised developer infrastructure, another example of attackers moving beyond direct smart-contract exploitation. The exchange traced the intrusion through a fake job interview, compromised software and internal systems before its wallets were drained.
Hardware security is facing similar pressure. Sui-native hardware wallet project Suiball said on November 10 that it would shut down and refund pre-orders after what it described as a decision by the Sui Foundation that supporting the project had become too risky following recent hardware-wallet attacks. The Sui Foundation had not publicly confirmed that account as of the latest available update.
What Should Investors Watch Next?
Across’s promised post-mortem will be important because the protocol has not yet explained precisely how Namecheap’s account controls were defeated or whether additional registrar safeguards failed. Confirmation of the number of victims and the final reimbursement amount will also determine whether GoPlus’s $350,000 estimate is accurate.
For Arcus, the immediate financial loss has been absorbed by the company, but the more important question is whether its review identifies similar accounting assumptions elsewhere in the platform.
Investor Takeaway
Recent incidents increasingly involve domains, employee systems, account permissions and business logic rather than a single class of smart-contract bug. Investors assessing crypto infrastructure therefore need to consider operational security and external service dependencies alongside code audits.
