Hackers Didn't Break Across Protocol, They Just Asked Nicely
Across Protocol's entire website was hijacked without touching a single smart contract — attackers simply talked their way into the domain registrar and redirected every visitor to a phishing trap.
The cross-chain bridge confirmed this week that a social engineering attack targeting Namecheap, one of the world's most widely used domain registrars, gave hackers enough access to silently reroute legitimate traffic. Anyone who visited the site during the window wasn't seeing Across Protocol. They were walking straight into a clone built to drain wallets.
The Attack Nobody Codes For
This is the breach that keeps security teams up at night, because no audit catches it. No bug bounty flags it. The vulnerability wasn't in the protocol, the bridge contracts, or the frontend code. It was a human being at a registrar picking up the phone, or replying to an email, and handing over access to someone who sounded convincing enough.
Social engineering attacks work because they exploit the weakest layer in any system: people. And in crypto, where protocols spend millions hardening on-chain infrastructure, the off-chain attack surface is often left dangerously exposed. Your domain registrar account is essentially the master key to your entire web presence, and most teams treat it like a forgotten utility bill.
What Actually Happened
The attackers compromised Across Protocol's domain through Namecheap, redirecting users to a phishing site designed to mimic the legitimate interface. The goal is always the same: get a connected wallet to sign a malicious transaction before the user realizes anything is wrong.
Across Protocol confirmed the site has since been restored and the domain is back under their control. The team has not disclosed how long the malicious redirect was live or whether any users lost funds during the window, which is exactly the kind of detail the community will be watching for in follow-up communications.
Why Every DeFi Protocol Should Be Nervous Right Now
This attack is a template. It requires no sophisticated exploit, no zero-day vulnerability, no insider access to private keys. It requires patience, a convincing story, and a registrar support agent having a bad day. The fact that it worked on a known, active cross-chain protocol should send a cold signal across the entire DeFi space.
What to watch and do right now:
- Bookmark official URLs and verify them every time before connecting a wallet to any bridge or DeFi protocol. - If a site looks even slightly off, treat it as compromised. Check official Twitter and Discord for incident notices before proceeding. - Protocols need to move domain management to registrars offering hardware-key-enforced 2FA and strict transfer locks, yesterday.
The bridge is back. But the method that took it down is still out there, and it works.