Cross-chain bridge protocol Across has restored its official website after adversaries successfully hijacked its domain through a sophisticated social engineering campaign. According to Cointelegraph, the incident involved attackers compromising the project’s domain registrar, Namecheap, to redirect traffic away from the legitimate platform. The protocol confirmed that the malicious redirection led users to a phishing site designed to deceive visitors.
The security breach highlights the vulnerabilities inherent in supply chain security for digital assets. By targeting the domain registrar rather than the protocol’s smart contracts directly, the hackers exploited a critical administrative point of entry. This method of attack underscores the importance of securing not just the blockchain infrastructure, but also the associated web services and registrar accounts that facilitate user access. The successful hijack demonstrates how attackers increasingly focus on peripheral services to compromise user trust and financial assets without necessarily breaking the underlying cryptographic security of the protocol.
Across Protocol has since taken corrective measures to regain control of the domain and ensure the safety of its community. While the immediate threat has been neutralized, the event serves as a stark reminder for other decentralized finance platforms to review their administrative security protocols. Ensuring robust authentication measures at the registrar level is now considered a standard requirement for maintaining operational integrity. Users are advised to verify domain authenticity before interacting with any cross-chain bridge services to avoid falling victim to similar phishing attempts in the future.
