According to CoinMeta, on November 10, 2026, at 18:45 UTC, Across suffered a hijacking attack by DNS. The attackers controlled its domain name through social engineering attacks on Namecheap and replaced the official website with a phishing site. Users suffered losses estimated at around $350,000, with funds stolen from users' wallets on Ethereum, Arbitrum, Base, BNB, Ink, and Plasma chains. The malicious addresses used by the attackers included: 0x46a2a474d4c22bf1ae4f8fa55da7a58673472be2, 0xdbd7fbe5b7cd56f99c059dc24052009d2626125c, etc. On November 11, 2026, at 01:16:45 UTC, Across announced that it had regained control of the domain name and promised to compensate the affected users.