Across Domain Hijack: How to Check and Revoke Token Approvals

Quick answer: On November 10, 2026, attackers hijacked the across.to domain through its registrar and served a phishing copy of the Across bridge. Across's smart contracts were not affected. If you visited across.to that evening and approved or signed anything, check and revoke token approvals on every chain you used, then move funds if you signed a permit.

What happened

Across is a cross-chain bridge that moves assets between Ethereum and other networks. At about 18:45 UTC on Tuesday, November 10, 2026, an attacker gained control of the across.to domain through a social engineering attack on Namecheap, the registrar where it was registered. The attacker pointed the domain at a convincing copy of the Across app built to drain wallets.

Across said it was alerted within 15 minutes and moved to shut the website down. Security response group SEAL911 helped flag the domain as phishing with major wallets, and Cloudflare marked it as risky and later removed its DNS records, Cointelegraph reported via TradingView. Across also suspended its frontend and API services during recovery.

By November 11, Across had regained control of across.to with help from Namecheap founder Richard Kirkendall. The team said all affected users would be made whole and promised a full post-mortem. Across has not confirmed the total loss. GoPlus Security estimated about $350,000 across six chains, Altcoin Buzz reported.

Why a domain hijack is different from a contract exploit

A DeFi app has two parts: smart contracts that hold and move funds on-chain, and a website that builds transactions for you to sign. In this incident the contracts kept working as designed. What changed was the website, so the transactions it asked visitors to sign were written by the attacker.

The fake page mostly asked for approvals and permits, not direct deposits. An approval gives a contract permission to move a token from your wallet, often for an unlimited amount, and it stays active until you revoke it. A permit is an off-chain signature that does the same thing without a separate approval transaction. Either one lets the attacker take tokens later, even after you close the page.

Across is not the first protocol hit this way in 2026. CoW Protocol's cow.fi domain was hijacked in April, and in early November attackers took over about a dozen DeFi websites registered with Name.com, including Flap, Kintsu, Pickle Finance and Origami Finance, stealing about $138,000, according to The Hacker News.

Who is affected

Your risk depends on what you did and when:

• Visited across.to after about 18:45 UTC on November 10 and signed an approval, permit or transaction: treat your wallet as exposed until you have checked it.
• Visited during the hijack but signed nothing: your funds should be safe. Clear your browser cache and check your approvals anyway.
• Bridged through a wallet, aggregator or app that calls Across's contracts directly: Across said third-party integrations and API users were unaffected.
• Used Across before November 10: older approvals to the real Across contracts are not the attacker's approvals. Revoking approvals you no longer need is still good practice.

How to check and revoke token approvals

Step 1: List the chains you used

The phishing page could ask for approvals on any chain your wallet was connected to. GoPlus's estimate covered six chains, so check every network you used that evening, not just Ethereum.

Step 2: Open an approval checker

Use a well-known tool such as Revoke.cash or the Etherscan token approval checker. Type the address of the tool yourself instead of clicking links in messages or search ads. Connect read-only first, or paste your public address. You never need to share a seed phrase to view approvals.

Step 3: Look for unfamiliar spenders

Sort by most recent approvals and look for anything granted on November 10 or 11, especially unlimited approvals for stablecoins or wrapped ETH. If a spender address is not a contract you recognize and intentionally used, treat it as suspicious.

Step 4: Revoke suspicious approvals

Revoking is an on-chain transaction, so you will pay a small gas fee on each chain. Confirm in your wallet that the transaction is calling "approve" with an amount of zero, or that it is an official revoke, before you sign it.

Step 5: Check Permit2 and off-chain permits

Some drainers use Permit2 or signed permits. Approval checkers increasingly show Permit2 allowances, but a signed off-chain permit can be used before it ever appears as an approval. If you signed a message you did not understand, the safest option is to move your assets to a new wallet.

Step 6: Move remaining funds if you are unsure

If you cannot rule out a malicious signature, create a fresh wallet with a new seed phrase, confirm you have backed it up, and transfer your remaining assets there. Do it soon after revoking, because attackers can act on a permit at any time.

What to do next

• Document what you signed. Note the time you visited, the chains you used and any transaction hashes. Across said affected users will be made whole, so keep these details for when its post-mortem and compensation process are published.
• Expect browser warnings for a while. Some wallets and browsers may keep flagging across.to as phishing after the fix. Wait for Across to confirm the site is safe before you dismiss a warning.
• Bookmark the apps you use. Opening bookmarks avoids look-alike domains and search-ad traps, but a bookmark cannot protect you from a hijacked real domain, so keep reading every signature request.

What to avoid

• Do not sign blind. If your wallet shows an approval for an unlimited amount or a permit you cannot read, reject it. Our guide to fake AI bot tutorials that drain wallets shows how these requests are disguised.
• Do not trust "support" accounts. Across's real updates come from its verified accounts. Impersonators reply to every complaint thread. Our coverage of Trezor phishing after an email breach explains how follow-up scams work.
• Do not ignore smart-account permissions. If you use a Safe or another smart account, check modules and guards as well as token approvals. See our guide to checking Safe module permissions.

Wallet-level protections help too. Our explainer on MetaMask's added protection features covers what transaction warnings can and cannot catch.

Official sources and status

• Across Protocol's verified accounts and official site for the post-mortem and compensation details.
• Cointelegraph via TradingView: Across restores website after domain hijack
• Revoke.cash and the Etherscan token approval checker

Frequently asked questions

Conclusion

The Across incident is a reminder that a trusted website can turn hostile even when the contracts behind it are safe. If you used across.to on the evening of November 10, check approvals on every chain, revoke anything unfamiliar, move funds if you signed a permit, and wait for Across's official compensation process. Read every signature before you approve it.

This article is for general information only and is not financial, legal or investment advice. The Onchain Support is an independent publication and is not affiliated with Across Protocol. We will never ask for your seed phrase or private keys.