At around 18:45 UTC on November 10, a bad actor took control of the across.to domain after a social engineering attack on registrar Namecheap and used it to host a phishing site.

The team was alerted within 15 minutes and moved to shut the site down. SEAL911 flagged across.to as a phishing domain with major wallets, and Cloudflare marked it as at risk before pulling its DNS records. The phishing page is no longer available.

Users who visited across.to before the block may have been affected, while third-party integrations and API users were not.

Across says Namecheap has been unresponsive, so its frontend and API will stay down until the domain is secured. Affected users are asked to revoke attacker permissions and share transaction details with the team, and a post-mortem is promised.