Across Protocol’s Domain Hijacked in Social Engineering Attack
TREE NEWS reports: Cross-chain protocol Across suffered a domain hijacking after its registrar, Namecheap, fell victim to a social engineering attack. The attacker gained control of Across’s domain around 02:45 Beijing time, prompting the team to receive alerts within 15 minutes and begin shutting down the website. Cloudflare subsequently revoked the domain’s DNS records, making the phishing site inaccessible. While some users who visited the site before the takedown may have been affected, third-party integrations and API users were not impacted. Across advises users who believe they were affected to contact the team and revoke any permissions granted to the attacker. The frontend and API will remain offline until the domain is securely restored.
Industry Analysis: The Rising Threat of Social Engineering
This incident highlights a growing trend in the crypto space: attackers are increasingly targeting the human element rather than smart contracts. Domain registrars, which hold the keys to a project’s online presence, have become prime targets. A successful social engineering attack on a registrar can allow attackers to redirect traffic to phishing sites, steal credentials, or trick users into signing malicious transactions. For DeFi protocols, the consequences can be severe, as users may unknowingly interact with a compromised frontend.
Across’s rapid response—alerting within 15 minutes and involving Cloudflare—likely mitigated the damage. However, the incident underscores the importance of robust operational security for crypto projects. Best practices include using registrars with strong security features like multi-factor authentication and domain lock, monitoring for unauthorized DNS changes, and educating users about phishing risks. The fact that third-party integrations and API users were unaffected suggests that the attack was contained to the frontend, but it serves as a reminder that the attack surface extends beyond code.
Forward-Looking Perspective: Strengthening the Weakest Link
As DeFi matures, security must encompass not just smart contracts but also the infrastructure that supports them. This incident may accelerate the adoption of decentralized domain systems or enhanced security protocols for registrars. Projects may also explore alternative frontend solutions, such as IPFS-hosted sites or decentralized gateways, to reduce reliance on traditional DNS. For now, Across’s swift action and transparency are commendable, but the event is a wake-up call for the entire industry: in crypto, the weakest link is often the one you least expect.
