For about three hours, Across Protocol's web address led to a wallet drainer. It drained $402K from 9 wallets. The widely shared $294K was a fee wallet's balance

Updated 12 November. A tip led us to an Ethereum transfer. We had missed it. One victim also lost its ether by a second route. Most of it reached the thief within ten minutes. That raises our total from $348K to $402K.

01 · What happenedWhat happened in the Across Protocol domain hijack

On the evening of 10 November, the web address across.to led people into a trap. The page looked like the one they used every week. Anyone who signed what it asked could lose their savings.

Across Protocol is a bridge, an app that moves crypto from one blockchain to another. Its app lives at across.to. Across said someone tricked Namecheap, the company that registers the name, at about 18:45 UTC. That gave them control of the address. For about three hours the address led to a copy of the app that emptied wallets.

That night a widely shared post by SolanaFloor put the loss at $294K. Bitquery reads each transfer on these chains, so we traced the stolen tokens ourselves. We found 9 wallets on five chains that lost about $402K between 19:02 and 21:53 UTC. The $294K matches another wallet. That one collects a 20% fee from many thefts, and most of its money was there before the hijack. We also traced the thief's share. Within an hour of gathering it in one wallet, the thief had sent almost all of it off Ethereum. It went to Bitcoin, to an online casino and into a token that tracks Monero, a coin built to hide who pays whom.

02 · The setupHow domain hijacking works

Projects rent their web addresses. A project pays a registrar, such as Namecheap, to hold its name. The registrar keeps the record that says which server the name points to. Your browser reads that record each time you type the name.

Whoever controls the registrar account can change that record. People then land on a server the thief runs. The address bar still shows the real name. Across's own code on the blockchains kept running as normal. Only the website was fake. This is domain hijacking, also called DNS hijacking. The Name.com DNS hijack hit 12 crypto sites the same way in October.

Across said it learned of the attack within 15 minutes and tried to shut the site down. SEAL 911, a volunteer team that responds to crypto attacks, got across.to flagged as a phishing site in major wallets. Cloudflare later pulled the site's records. Late that night Across said the fake site was offline. Early the next morning it said it had the domain back.

03 · The nightThree hours, nine wallets

The first drain we found landed on Arbitrum about 18 minutes after the takeover time Across gave. The last came almost three hours later, when the thief emptied one wallet on Optimism and then on Base, seconds apart. In between, the thief took tokens on Ethereum and BNB Chain too.

The fake site checked each chain where a wallet held money and asked for each in turn, which is how one victim lost money on two chains in the same minute. Most victims lost a few thousand dollars. Two lost far more, both on Ethereum, a few minutes either side of 20:00 UTC.

04 · The splitA wallet drainer for hire, split 80/20

The fake site ran a wallet drainer, a script that asks visitors to sign away their tokens. Sellers rent out kits like this. The people who run the scam keep most of what they take, and the kit's seller takes a cut.

Here the cut was exact, with each token drain paying 80% to one wallet and 20% to another, every time in the same transaction and down to the smallest unit of the token. The 80% wallet only received money while the fake site was up, which fits whoever hijacked across.to. The 20% wallet, the fee wallet from here on, is older. Since 25 September it has taken a fee from about 290 drained wallets on Ethereum, which fits the kit's seller.

That fixed split is how we tied each token drain to this attack. The fee wallet took a 20% cut from other wallets that night too. But their other 80% never reached the thief's wallet, so we left them out.

One victim also lost ether by a second route, which we call the ether sweep. Shortly before the biggest theft of the night, 26.38 ETH, about $54K, left the victim's account in one transaction. The victim's smart wallet sent it, and a third party paid the fee. The ether went to a collector, which kept 5% and passed the rest to a payout address twelve seconds later. About ten minutes after the theft, the payout address sent 20.95 ETH to the thief.

The same wallet had lost tokens to the 80/20 split 13 minutes before. Earlier that evening, 25.92 ETH had arrived in it from another of the nine victims, seconds after the thief drained that one on Arbitrum. The payout address has also paid an address that took 80% of a different drain that night, with 20% going to the same fee wallet. So we count this ether as part of the hijack. The collector itself is older than the hijack. It has taken ether from more than 300 addresses since early August.

05 · The lossesHow much the hijack took

We counted about $402K taken from 9 wallets, using each token's price at the moment of the theft. Of the $348K taken as tokens, the thief's wallet got 80% and the fee wallet the rest. The other $54K is the ether that went by the second route.

One loss dwarfs the rest. A single depositor in Aave, a lending app, lost $305K, 76% of the total. The other eight wallets lost $97K between them. The next biggest was about $55,200, mostly the ether taken by the second route. The rest lost a few thousand dollars each, much of it in USDC, a token worth one dollar. Two wallets also lost tokens that have no market price, so our total leaves those out.

Almost all the money came from Ethereum, because of the Aave deposit and the ether taken by the second route. Arbitrum and Base had the most victims, three each.

06 · AaveOne Aave depositor lost $305K

When you deposit ether in Aave, you get aWETH back, a token that stands for your deposit and earns interest. This user had a large deposit.

The fake site asked for a permit, a signed message that lets someone else move your tokens. Signing one costs nothing and sends nothing. It looks harmless. The thief used the permit soon after 20:00 UTC and pulled the deposit out in four steps over three minutes. The kit split each pull 80/20.

A minute after the last pull, the owner cancelled the approval. It was too late. By then the thief had swapped most of the aWETH for ether through UniswapX, a trading service.

07 · The $294KWhere the $294K figure came from

The $294K in early reports matches the fee wallet's holdings, the wallet that takes 20%. That balance mixes two things. Some of it came from the Across victims that night. Most came from older thefts. By our count, at least $167K of it, 57%, was there before the hijack began.

So the $294K gets the story wrong twice. It leaves out the $278K that went to the thief. And it counts older money that has nothing to do with Across.

08 · The moneyWhere the thief's share went

The thief moved fast. It swapped the tokens from the other four chains and moved them to Ethereum. Relay and deBridge, two services that move money between chains, carried them. A further 20.95 ETH came from the payout address behind the ether sweep.

Just after 20:15 UTC, the thief gathered most of its ETH, about $299K, in a new wallet, which we call the splitting wallet. That wallet split it three ways, and within the next hour each part left Ethereum by its own route.

The payout address mixed in ether from other sweeps, so each route may carry a little money that did not come from Across's users. From the first swap to the last casino deposit, the whole cash-out took under four hours.

09 · HyperliquidInto a Monero token on Hyperliquid

The first part, about $100K, went to two fresh wallets. Each wallet bridged its ETH to Arbitrum with LI.FI, a bridge service, got USDC back, and within two minutes put that USDC on Hyperliquid to buy XMR1. Hyperliquid is a crypto exchange that runs on its own blockchain.

XMR1 is a token on Hyperliquid that tracks Monero. If the thief withdraws the token as real Monero, the trail ends there. Early on 11 November, the two wallets still held XMR1 worth about $101K.

10 · SolanaInto an online casino, by way of Solana

The second part, also about $100K, went through Chainflip, a service that swaps coins across blockchains. Three minutes later it arrived on Solana as SOL, that network's own coin.

The SOL sat still for about two and a half hours. Then it moved. Shortly before midnight UTC, it went in two parts to a wallet with no activity in the month before. Each time, that wallet passed the money on within 22 seconds to a wallet our address labels mark as the hot wallet of Rainbet, an online casino. A hot wallet is the one a business uses for day-to-day payments. The quick pass-through fits a casino deposit address, which a site gives each customer to pay in.

11 · BitcoinInto Bitcoin, still unspent

The third part, about $96K, went into THORChain. That is a network that swaps coins between blockchains with no exchange in the middle. Less than two hours later, THORChain paid out 1.305 BTC to a new Bitcoin address. That address had not spent any of it when we last checked.

12 · NowWhere the money is now

About $35K is still on Ethereum. Most of it sits in a side wallet the thief filled that night. It has not moved since. At 01:20 UTC on 11 November the thief sent 3.43 ETH from its own wallet to a new address. That ETH has not moved since.

Someone other than the thief could still stop two of these parts. Rainbet can freeze the account behind the deposit address, and whoever issues XMR1 may be able to block the tokens before anyone takes them off Hyperliquid. For the Bitcoin and the idle ETH, all anyone can do is watch. Anyone can follow these wallets with the Bitquery MCP. Across has said that all affected users will be made whole.

13 · What to doIf you used across.to on 10 November

Check what you signed. If you connected a wallet to across.to that night, revoke every token approval you gave, on every chain you use. A tool such as Revoke.cash lists them. A signed permit leaves no trace until someone uses it. So check your Aave deposits and other tokens too.

Across asked affected users to send it their transaction details. Use only its official X account. Ignore anyone who offers to get your money back for a fee. They are scammers too.

Address-poisoning bots also copied the thief's transfers with fake tokens from look-alike addresses, hoping someone will later copy a wrong address from their history and send money there. We have tracked those bots before, and covered other wallet drains this autumn, such as the Predict.fun hack.

14 · The methodHow we traced the Across Protocol domain hijack

With Bitquery's data, we read every transfer into the two wallets on 10 November, from 18:00 to 22:30 UTC. We did this on Ethereum, Arbitrum, Base, BNB Chain and Optimism. We kept the drains that paid both wallets in an 80/20 split. We also traced the ether that reached the thief's wallet from elsewhere back to the victim it came from. Then we followed the thief's ETH from wallet to wallet until it reached Hyperliquid, Solana and Bitcoin. We traced earlier drains the same way, such as the Polymarket hack.

Each dollar figure uses the token's price at the time it moved. The full history of these chains is also sold as files on the Bitquery Data Store: the Ethereum, Arbitrum, Base, BNB Chain, Optimism, Solana and Bitcoin datasets. For cases like this one, we also offer crypto investigation services.

15 · The recordThe addresses behind the hijack

FAQ

Was Across Protocol hacked?

Its web address was taken over. Across said a social engineering attack on its registrar, Namecheap, gave someone control of across.to at about 18:45 UTC on 10 November. Across said no third-party integrations or API users were affected.

How much was stolen in the Across Protocol domain hijack?

We traced about $402K taken from 9 wallets on Ethereum, Arbitrum, Base, BNB Chain and Optimism. One Aave depositor lost $305K of it.

Why did early reports say $294K?

That figure matches the holdings of the wallet that takes a 20% fee for the drainer kit. Most of that balance came from older thefts, and it leaves out the 80% that went to the thief.

Where did the stolen money go?

The thief split its share three ways. About $100K became XMR1, a Monero token on Hyperliquid. About $100K went to the Rainbet casino by way of Solana. About $96K became Bitcoin, and about $35K was still on Ethereum.

Will Across victims be repaid?

Across said on 11 November that all affected users will be made whole and that it would publish a full post-mortem.

Is the Across bridge safe to use now?

Across said on 11 November that across.to is back under its control and that all its systems work normally. Type the address yourself or use a bookmark, and check the project's official X account before you connect a wallet.

What is a crypto drainer?

A crypto drainer, or wallet drainer, is a script on a fake site that asks you to sign requests that hand over your tokens. Sellers rent these kits to scammers for a share of each theft.

What is domain hijacking?

It is when someone takes control of the record that says where a website lives. Visitors type the right name and land on a page the thief runs.