Across, a cross-chain protocol specializing in interoperability solutions, has successfully restored its systems following a domain hijack attack that compromised its official web infrastructure. The security incident involved attackers gaining unauthorized control of the project's primary domain through targeted social engineering tactics aimed at its service provider.
According to The Block, the attackers exploited vulnerabilities in human processes at Namecheap, the domain registrar responsible for managing Across's DNS infrastructure. By successfully executing social engineering techniques against the registrar's support or administrative systems, the threat actors obtained control of the official domain, creating a significant security concern for the protocol and its users.
Domain registrar compromises represent a particularly insidious attack vector within the cryptocurrency ecosystem because they target the foundational internet infrastructure that underlies even the most decentralized protocols. Unlike exploits that target smart contract code or blockchain consensus mechanisms, registrar-level attacks bypass on-chain security entirely by compromising the centralized services that maintain domain name system records. These DNS records serve as the directory for users seeking to interact with decentralized applications, making their integrity crucial for ecosystem security.
Social engineering attacks against registrars typically involve manipulating customer service representatives through pretexting, or exploiting weak authentication procedures to transfer domain ownership or modify DNS settings. Once control is established, attackers can redirect traffic to malicious servers, intercept communications, or distribute compromised versions of wallet interfaces. The success of such attacks depends not on the cryptographic security of the blockchain protocols themselves, but on the operational security practices of third-party domain management providers.
The restoration of Across's systems indicates the protocol has regained administrative control of its domain and rehabilitated its web infrastructure. Recovery from such incidents requires coordination with the registrar to reverse unauthorized changes, audit all DNS configurations for persistence mechanisms or backdoors, and implement enhanced authentication measures to prevent recurrence. The protocol must also communicate with its user base to ensure no interactions occurred with potentially compromised interfaces during the attack window.
This incident underscores the persistent challenge of securing the full stack of cryptocurrency infrastructure, extending beyond blockchain architecture to encompass traditional internet services. While decentralized finance protocols implement rigorous smart contract auditing and multi-signature controls for on-chain operations, the domain registration layer often remains vulnerable to the same social engineering tactics that target traditional corporate infrastructure. Projects must maintain stringent security protocols for all centralized service providers, including domain registrars, hosting services, and email systems, to ensure comprehensive protection against infrastructure-level compromises.