Across Domain Hijack Began 18:45 UTC After Namecheap Attack

There was one person who convinced the registrar to hand over the access for across.to, and the official website of Across was redirected to the phishing site. The Across domain hijack took place around 18:45 UTC on 10th November according to the protocol. The domain name across was retrieved back on 11th November.

The Across domain hijack in this situation is caused not by the vulnerability of smart contracts, but by the vulnerability of the account of the registrar. The registrar mentioned by Across, which is Namecheap, was attacked via social engineering and got "control of the Across domain."

What Across has said about the Across domain hijack

First announcement was done by the protocol via its X account at 22:13 UTC on November 10, which is over three hours after the attack occurred. In that case, they said that the domain was down while the team secured it. On top of that, they have mentioned that they were notified within 15 minutes from their attack. If we calculate it from 18:45 UTC, then the notice came after 3 hours and 28 minutes, and the all-clear took place 6 hours and 31 minutes later.

The second notification was made at 01:16 UTC on November 11. Across announced that across.to was now under its control and all the systems were functioning properly. Across thanked the founder of Namecheap, who responded on X, for helping them secure the account and open an investigation.

As per The Block, Across has stated that the affected users will be compensated. The number of affected users and the amount lost have not been revealed by Across yet.

Loss estimate and who is exposed

According to The Block, the loss suffered by users was estimated at roughly $350,000 by GoPlus Security. The money had been stolen from wallets on the Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma networks. This figure is an estimate by a third party.

The Across post from November 10, saying a social engineering attack on Namecheap gave an attacker control of the domain. Source: Across on X.

The key point in this case is the method, not the number. The hijacked website may be employed to launch a copy of the real application. The moment when a user launches the application and links their wallet, the user can be prompted to approve token allowance or permit. The permission granted to the attacker keeps working even after the window is closed.

In saying that, the exposure period is not from the whole of November 10th. It applies to the users that visited across.to after about 18:45 UTC and signed something. The user that was accessing the bridge at any other time or through any other application was not part of the attack vector.

A second domain hijack in two weeks

The Across domain hijack is not even the first domain hijacking to occur within the month. According to The Block, on October 31, a dozen DeFi websites registered at Name.com were hijacked, resulting in about $138,000 being stolen.

In this particular scenario, all other aspects of the procedure were correct, apart from the front door entry point. Nothing prevents you from securing your registrars using more verification steps on top of it, while monitoring your own DNS. But all of this would work out only if you succeed in getting through to the registrar from the phony owner.

Two issues need to be solved here: how many wallets signed the transaction and how they got around the verification process from the registrar. This article only contains information from public sources and does not provide financial recommendations.

Featured image: Crypto Hacking Concept by edwinchuen, licensed CC BY 2.0, via Wikimedia Commons.