Across Protocol warns users to avoid app amid reports of drained wallets

Across Protocol, a cross-chain bridging protocol, issued an urgent warning on Tuesday, November 10, telling users to stay away from its app. In a post on X, the team said it was investigating an issue with its domain. Until further notice, users were asked not to visit the app, connect their wallets, or sign any transaction or approval there.

Cointelegraph reported that the protocol is investigating a potential security incident affecting its domain, and that several users have reported losing funds after interacting with the app. A KuCoin news item citing on-chain reports said some of the reported losses included about $9,000 in USDC and 7,053 USDT, which were drained via the Plasma network. These figures come from user and on-chain reports. They are not a confirmed total from Across.

The Defiant noted that the alert does not establish whether Across's smart contracts or its bridging operations are affected. That distinction matters. At the time of these reports, the warning concerned the web domain and the app interface that users reach through it. The team had not said that the underlying contracts had been exploited.

Across is a well-known piece of crypto infrastructure. TFTC described it as a cross-chain bridge with more than $40 billion in lifetime volume and more than 5 million wallets on record. That scale is one reason the warning drew attention. A large user base means many people may have granted token approvals through the app in the past.

In general terms, a domain compromise happens when an attacker gains control over a website's address or its hosting, for example through DNS settings or a registrar account. The attacker can then show users a malicious version of the front end. The front end may ask users to sign transactions or token approvals that give the attacker access to their assets. In that kind of incident the underlying smart contracts can stay intact, while users who connect a wallet to the altered site are still exposed. Across has not confirmed that this is what happened here, and the investigation was ongoing at the time of the reports.

The wording of the warning is specific. It covers signing a transaction and also signing an approval. Token approvals are permissions that let a smart contract move a certain amount of a user's tokens. A malicious approval can be exploited later, even if the user takes no further action. For this reason, security researchers often recommend that users who think they interacted with a compromised site review and revoke token approvals with a reputable approval-management tool. That is general security guidance and not a statement about any particular user's situation.

As of the reports, Across had not published a full explanation of the cause, the number of affected users, or the total value lost. It also had not given a timeline for when the app would be safe to use again. Users who follow the project's official channels will see updates as the team shares them. The protocol has urged people not to use links from unofficial sources while the incident is open.

The incident adds to a run of security problems in the crypto industry this week. Cointelegraph's front page also covered a $49 million hack at Brazilian exchange Mercado Bitcoin, which said it would resume cash deposits and withdrawals through the Pix payment system next week. The two cases are not known to be connected.

This article is for information only and is not financial or investment advice. Details may change as Across and independent security researchers publish more findings.

This is a news summary for general information only — not financial advice, and nothing here is a recommendation to buy, sell, or hold any asset. Always verify against the original source and do your own research before making a financial decision.