Hijacked cross-protocol website -. A reported $350,000 was stolen across six blockchains.
Another major DeFi security incident exposed a dangerous weakness outside of smart contracts.
The site itself.
Cross-chain interoperability protocol ACROSS suffered a domain takeover on November 10 after attackers manipulated its domain registrar using a social engineering attack.
The destination was NAMECHEAP.
According to Across, the attackers gained control of the protocols official domain around 18:45 UTC.
Instead of sending visitors to the legitimate interface, the hacked domain directed them to a malicious site designed to empty crypto wallets.
And the attack spread across several networks.
The GOPLUS security platform estimates about $350,000 in user losses including wallets on ETHEREUM, JUDGE, BASE, BNB CHAIN, INK and PLASMA.
But these losses did not come from attackers who broke the consensus system of sites.
They came from malicious wallet permissions.
The fraudulent website encouraged visitors to authorize token transfers or sign permissions that could allow attackers to withdraw assets.
This is an important distinction.
A blockchain protocol can have secure underlying contracts while attackers exploit the interface that people use to interact with them.
Across says it detected the domain takeover within about 15 minutes.
The security response group SEAL911 helped flag the malicious domain, while Cloudflare and the registrar became involved in restricting the attackers' access.
By November 11, ACROS had regained control of its domain.
The protocol announced that its systems were working normally again.
And it received another important commitment.
Affected users will be made whole.
Across says it intends to compensate users affected by the attack and will publish a detailed investigation.
However, the loss figure of about $350,000 comes from GoPlus.