Cross-chain infrastructure faces renewed scrutiny after two distinct security incidents struck Initia and Across Protocol within hours of each other, underscoring how operational and supply-chain vulnerabilities continue to expose users and funds even when core smart-contract code remains intact.
Initia suffered its second exploit in three weeks when an attacker used compromised cloud credentials to steal approximately $3.27 million in crypto assets, according to Cointelegraph. The project stated that roughly $2.16 million of the stolen funds remained frozen on its halted network following the breach. The incident marks the second successful attack against the platform in a short timeframe, shifting attention from on-chain logic flaws to off-cloud infrastructure and key management practices that bridge operators rely on to custody or move assets. The repeated nature of the compromise raises questions about whether continuity-of-operations safeguards and credential-rotation policies are keeping pace with the threats faced by networks that sit between multiple blockchains.
Simultaneously, Across Protocol's public-facing infrastructure came under assault through a different vector. The cross-chain bridge restored its website after hackers hijacked its domain through a social engineering campaign targeting domain registrar Namecheap, Cointelegraph reported. The attackers redirected visitors to a phishing site, creating the risk that users would unknowingly approve malicious transactions or reveal sensitive wallet data. Unlike a smart-contract exploit, the compromise originated entirely outside the protocol's blockchain stack, leveraging weaknesses in traditional web infrastructure and third-party vendor relationships that many decentralized projects still depend upon for user onboarding and support.
Together, the two episodes illustrate a broader pattern in which cross-chain platforms are targeted not at the protocol layer but at adjacent systems—cloud hosting accounts, domain registrars, and employee credentials—that govern how projects present themselves online and manage operational keys. As bridging solutions increasingly aggregate liquidity across disparate networks, the surface area for attacks has expanded beyond immutable contract code to encompass mutable off-chain environments that remain difficult to monitor and harden at scale. The attacks demonstrate that an adversary does not need to find a flaw in a bridge's verification logic if they can instead obtain the keys that authorize withdrawals or manipulate the front-end interface that users trust.
The temporal proximity of the Initia and Across Protocol events amplifies industry concerns that social engineering and credential theft are becoming preferred paths of least resistance for attackers seeking to siphon funds or trap users. While blockchain bridges have historically drawn criticism for smart-contract bugs and flawed cryptographic design, the latest incidents suggest that robust contract audits alone are insufficient when the surrounding infrastructure—from domain management to cloud access—can be undermined with a single compromised password or a manipulated support agent. Projects that facilitate asset movement between chains must now treat domain registrars, hosting dashboards, and internal communication channels as critical components of their trust model rather than peripheral IT concerns.
For users, the practical consequence is that trust assumptions now extend well beyond the bytecode of a protocol to include the security posture of domain registrars, hosting providers, and internal access controls maintained by development teams. Neither Initia nor Across Protocol's reported issues involved exploited on-chain logic, yet both carried the potential for significant financial loss and reputational damage. As cross-chain interoperability continues to scale, the sector faces mounting pressure to implement hardened identity verification, multi-factor authentication on critical vendor accounts, and real-time monitoring of DNS and cloud configuration changes to close gaps that exist outside the chain but directly affect assets on it.