{
  "id": "across-domain-hijack",
  "url": "https://ohshit.app/incidents/across-domain-hijack/",
  "title": "Across domain takeover exposed visitors to a wallet drainer",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-10",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Across",
    "wallet drainer",
    "DNS"
  ],
  "ecosystems": [],
  "summary": "Across says a registrar social-engineering attack redirected its website to a wallet drainer. Bitquery estimates about $348,000 taken from nine wallets on five chains. Across regained control and pledged to cover affected users.",
  "splash": "Visitors who connected a wallet or signed an approval, message or transaction on the compromised Across frontend on November 10.",
  "wipe": "From a trusted wallet interface, revoke suspicious approvals on each affected chain and report transaction hashes to Across.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Check every connected wallet and chain",
      "hint": "Open Revoke.cash directly and load the wallet used on Across. Select each network, search by the spenders below, and check direct approvals and Permit2 allowances. Revoke matching rows, confirm the on-chain transactions with the network’s gas token, then verify zero or removed allowances. Unused signed permits may be invisible. If you signed during the incident, Across recommends moving remaining assets to a fresh wallet after revoking visible approvals. Direct transfers are final."
    },
    {
      "title": "Preserve evidence and report through official channels",
      "hint": "Save wallet addresses, timestamps, chain names and transaction hashes. Initiate contact through the verified Across account named in the notice. Keep recovery phrases and private keys private and ignore unsolicited recovery offers."
    },
    {
      "title": "Correlate tracing indicators",
      "hint": "Bitquery’s address record lists 13 wallet addresses and two transaction hashes. The reported recipient pair is 0x2846e69d3298e99eddf2fd8116e952844da11fde and 0x0c7c656126aa62625fdd8051eb69dc14aee8d37b. The complete address and transaction record appears below. Check full addresses and event logs. A match alone does not establish compromise."
    }
  ],
  "sources": [
    {
      "name": "Across initial notice, public copy",
      "url": "https://teapawt.org/AcrossProtocol/status/2120278803318489362",
      "says": "Reproduces the official account’s registrar, containment and API/integration scope statement and links its follow-up approval guidance.",
      "primary": true
    },
    {
      "name": "Across user action notice, public copy",
      "url": "https://teapawt.org/AcrossProtocol/status/2120278805084295328",
      "says": "Names the approval checker, revocation guide and official reporting channel.",
      "primary": true
    },
    {
      "name": "Across detailed wallet recovery guide",
      "url": "https://docs.google.com/document/d/1IW3_cSr9fANfxHSXgVnzQ89Bitqv00Xbk-8bhx3L3kM/export?format=txt",
      "says": "Lists spender contracts, receiving addresses, Permit2 checks and how to verify revocation.",
      "primary": true
    },
    {
      "name": "Across restoration notice, public copy",
      "url": "https://teapawt.org/AcrossProtocol/status/2120324818385912082",
      "says": "Reproduces the team’s restoration and reimbursement commitment.",
      "primary": true
    },
    {
      "name": "Bitquery original on-chain investigation",
      "url": "https://bitquery.io/investigations/across-protocol-domain-hijack",
      "says": "Explains wallet attribution, valuation, fee-wallet distinction, and limitations.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "Across confirmed the takeover. Bitquery traced transfers during the phishing window.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 10, 22:13 UTC",
      "title": "Across reports the registrar takeover",
      "body": "Across dates the takeover to approximately 18:45 UTC. The team says Cloudflare pulled DNS records after the site was flagged."
    },
    {
      "date": "Nov 11, 01:16 UTC",
      "title": "Across confirms restoration",
      "body": "The team says it controls the domain again, promises compensation and plans a postmortem."
    },
    {
      "date": "Nov 11, 2026",
      "title": "Bitquery verifies its tracing figures",
      "body": "It attributes about $348,000 across nine wallets based on the timing and shared recipient split."
    }
  ],
  "body_markdown": "The official [initial notice](https://x.com/AcrossProtocol/status/2120278803318489362) says the registrar attack gave a third party control of the domain. Across says its API and third-party integration users were outside the affected scope, although the team temporarily took the frontend and API offline during containment. The [restoration notice](https://x.com/AcrossProtocol/status/2120324818385912082) pledges to make affected users whole. The [user action notice](https://teapawt.org/AcrossProtocol/status/2120278805084295328) explains how to revoke permissions and report affected wallets. The notices provide no completed compensation or final victim total.\n\nBitquery identified transfers between 19:02 and 21:53 UTC on Ethereum, Arbitrum, Base, BNB Chain and Optimism, with about $348,000 valued at transfer time. Its estimate uses a common 80/20 split and excludes transfers outside its data or method, including unpriced tokens in the dollar figure. A separate $294,000 figure matches the fee wallet balance, which includes older proceeds. Neither amount establishes the number of people affected or a compromise of the bridge contracts.\n\nBitquery’s reported addresses and transaction hashes, in report order. Addresses include downstream services and are evidence for correlation.\n\n```text\n0x2846e69d3298e99eddf2fd8116e952844da11fde\n0x0c7c656126aa62625fdd8051eb69dc14aee8d37b\n0x38d7e8b3c9561caf096c06c62c7561f8ab6e514c\n0xa490cde73adcd40475025ee8710f3a5ab7393194\n0xf10a482fbc02195f2dafca5d9dfd19c871b0f4a5\n0x0f67a21780699bb5c5e6b5f986c0bab26bfffe5c\n0x09360fe2e18fdfa49beb7592b9f24f94c5465533\n0xf229f808fe21911f8bcc24ebb30a85bd2e4c00f0\nG47n6dbUor1WFweLvKPrUi5beW4yjRoFG3cJZU6a4uSa\n2K7fueB3tqYBb5Z2Ubnnpf2rF3sJr1fJDKXtsocTAWmk\n5HQZd9ovzAF1TLnHRAq1zcSnXC9HAp3EwhoxMHvo8rxB\n0xbca05d20dbb271fd607e69fdc8d955be3bfc8120\n3EQ9Rqrtvco4nKmskv2jQRXvWKkpUGfAQs\n0x2610f11fd3cde7113f83e7137853972ba98d8360b3d91eed6d5807f947a8bd38\n0x19c5460db37f5cc2bde6f8f644892a5348a1519d2aa97f720091e982134a8ae1\n```\n\nAcross’s wallet recovery guide lists the following spenders by network. The guide says these addresses can be reused on other chains. Check Permit2 allowances on Ink and both direct and Permit2 approvals on BNB Chain.\n\n```text\nEthereum  0x46a2a474d4c22bf1ae4f8fa55da7a58673472be2\nEthereum  0xdbd7fbe5b7cd56f99c059dc24052009d2626125c\nBase  0x5ff35703c22533398d5c7ce7acd32a04ac8462da\nArbitrum  0x2ff67cddd9ff45e0b47957d9d7c19b0732f9c514\nArbitrum  0x373c415ef034bb620e8d720afd2ace26bca13529\nInk  0xdcd65e3a8f3b73c7e2f40dbab1fb95dbef871d6c\nPlasma  0x3ef438c34ce51a697a24247fe033c4562c94f0fd\nBNB Chain  0x0c894c253c62eda066197011efd73b632dc96263\n\nReceiving addresses listed by Across\n0x2846e69d3298e99eddf2fd8116e952844da11fde\n0x0c7c656126aa62625fdd8051eb69dc14aee8d37b\n0x3ef438c34ce51a697a24247fe033c4562c94f0fd\n0xa0e6c7d79b74d1a6d366dd11309b6faafda05ac5\n\nPermit2 contract for context\n0x000000000022d473030f116ddee9f6b43ac78ba3\n```"
}