In a report published on November 11, 2026, PANews cited an Across post on X saying that a social-engineering attack on its registrar, Namecheap, had given an attacker control of the cross-chain protocol’s domain at around 02:45 Beijing time that day. Across said its team received an alert within 15 minutes and began shutting down the website.
SEAL911 marked across.to as a phishing site. Cloudflare subsequently revoked the domain’s DNS records, making the phishing site inaccessible. Across said some people who had visited across.to before that intervention might have been affected, while third-party integrations and API users were not affected.
Across said it would compensate all affected users and advised them to revoke relevant approvals through revoke.cash. It also said its front end and API would remain closed until the domain was secure. These are the conditions reported at the time, not a confirmation of their current status.
Original report: PANews · Published November 11, 2026, at 06:24 Beijing time.
