As reported by ChainCatcher on November 11, 2026, cross-chain protocol Across said it had regained control of its official website domain and that all systems were operating normally. Across said it would fully compensate affected users and publish a complete post-incident report in the following days. Those were commitments at the time of reporting, not confirmation that compensation had been paid or the report published.
According to an earlier account from Across, an attacker gained control of the domain through a social-engineering attack targeting domain registrar Namecheap. While the domain was out of Across’s control, security response team SEAL 911 helped flag it as a phishing site. Across said some wallets or browsers might still display phishing warnings and expected those warnings to clear soon.
The reported trust boundary was control of the website domain. The account does not establish that the cross-chain protocol itself was compromised.
