Across Protocol, a cross-chain bridge and intent-based settlement platform in the decentralized finance ecosystem, has told users to stop interacting with its application while it investigates what appears to be a serious security compromise at the domain level. The warning arrives alongside credible user reports of wallets being emptied after connecting to the platform — the kind of incident that, regardless of its technical root cause, shakes confidence in an entire category of Web3 infrastructure.
The protocol's advisory is unambiguous: stay away from the app until further notice. That bluntness is both appropriate and notable. Too often in the history of decentralized finance exploits, teams have hedged their public communications while users continued to connect wallets and suffer losses. Across Protocol's decision to issue a clear, public warning before the investigation is complete reflects a more mature incident-response posture — though the damage to users who interacted before the alert was issued may already be done.
Domain-Level Compromise: A Different Kind of Threat
What distinguishes this incident — at least at this early stage — is the nature of the suspected attack vector. Across Protocol's investigation is focused on its domain rather than its underlying smart contracts. This is a critical distinction. A smart contract exploit typically targets the on-chain logic of a protocol, draining liquidity pools or exploiting faulty code embedded in the blockchain itself. A domain-level compromise, by contrast, is an attack on the Web2 infrastructure that sits in front of the decentralized system: the website users navigate to when they want to interact with the protocol.
In a domain attack scenario, malicious actors can redirect users to a fraudulent front-end that mimics the legitimate application. When a user connects their wallet and approves a transaction on that spoofed interface, they may be signing permissions that transfer their funds to an attacker-controlled address — not to the legitimate protocol. The underlying smart contracts may be entirely intact, yet users still lose everything they hold. This attack model has claimed victims across multiple high-profile incidents in the broader DeFi space over recent years, and it is particularly insidious because it exploits user trust in a visual interface rather than technical vulnerabilities in code.
Users Reporting Real Losses
The reports emerging from Across Protocol's user community describe wallets being drained after direct interaction with the platform. While the full scope of losses has not been quantified at this stage of the investigation, even a handful of confirmed incidents involving wallet drainage constitutes a significant event — both for the individuals affected and for the protocol's operational credibility. Cross-chain bridges already occupy a high-risk position in the DeFi security landscape, having been the target of some of the largest exploits in the industry's history. An incident layered on top of that reputational context demands rapid, transparent resolution.
Users who connected their wallets to the Across Protocol application around or before the time of the warning should take immediate precautionary steps: reviewing and revoking any token approvals granted to suspicious addresses using tools designed for that purpose, transferring assets out of potentially compromised wallets, and monitoring transaction histories for unauthorized activity. The fact that a domain-level attack can harvest wallet approvals means that simply disconnecting from a site may not be sufficient — the approvals signed during a compromised session can persist on-chain indefinitely until manually revoked.
Infrastructure Trust Is the Real Casualty
Incidents like this one expose a structural tension at the heart of decentralized finance. The smart contracts may be audited, formally verified, and battle-tested — but the moment users need a web browser and a domain name to reach them, the attack surface expands into territory that blockchain technology does not govern. Domain registrars, content delivery networks, DNS (Domain Name System) providers, and front-end hosting services all represent points of failure that exist entirely outside the trust model that DeFi protocols are built to offer.
The industry has long grappled with this gap. Solutions including InterPlanetary File System (IPFS) hosting, ENS (Ethereum Name Service) integration, and browser-native wallet warnings for suspicious approvals have been proposed and partially deployed. But the persistent recurrence of front-end and domain attacks suggests that the tooling and practices available today are still insufficient for the scale of assets flowing through DeFi interfaces. Until that infrastructure gap closes, even a protocol with flawless on-chain code remains only as secure as its weakest off-chain component.
Across Protocol's investigation is ongoing. What the final findings reveal about the precise attack vector — whether a compromised DNS record, a hijacked registrar account, or malicious code injected into the front-end — will matter enormously for how the broader ecosystem responds and what remediation looks like. For now, the clearest signal for users remains the one the team has already sent: do not interact with the application.
Written by the editorial team — independent journalism powered by Bitcoin News.