Across made an emergency announcement on November 10, requiring users to stop opening the app, not connecting to wallets or signing authorizations. The team is investigating an information security incident that may be related to the network domain; many users in the community have reported that their wallets have been stolen, and officials are requesting transaction details one by one. (Previous summary: $ACX soared by 80%! Across Protocol plans to reorganize DAO into an entity company, and tokens can be exchanged for equity at a 1:1 ratio or redeemed at a premium) (Background supplement: Verus Ethereum cross-chain bridge was attacked! Blockaid monitoring: loss of more than 11.58 million US dollars) Cross-chain bridge protocol Across Protocol passed X on November 10 Issue an announcement requesting users not to open their own applications, not connect to their wallets, or sign any transactions or authorizations during the investigation until further notice. This is the first official statement released after the incident was exposed. The post did not explain the nature of the incident, nor did it confirm whether the website had been hacked. Across is a cross-chain bridge that allows users to move assets between Ethereum and other blockchains. In the official announcement, the team only stated that it is investigating "potential security incidents" and promised to continue to update the progress. For users who still have Across authorization, there is currently only one official guideline: don’t move yet. ALERT We're currently investigating an issue with the Across domain. Do NOT visit the app, connect your wallet, or sign any transaction or approval there until further notice. We will post updates as we have them. — Across (@AcrossProtocol) November 10, 2026 The disaster report on the community side came faster than the official statement. One user stated that he lost approximately US$9,000 worth of USDC after the operation; another user reported that a total of 7,053 USDT0 were transferred out in seven transactions on the Plasma chain, which is equivalent to clearing the stablecoin balance in the wallet at once. A third user pointed out that his wallet was emptied after using the bridge multiple times, and claimed that the website had been hacked. Across responded to these returns by requesting a hash of transactions one by one to trace the flow of funds. The above-mentioned losses are currently only reported unilaterally by the users and have not been independently verified. Across did not respond to detailed inquiries before deadline. However, this publication actually parsed the two domains across.to and status.across.to before the deadline, and both reported that they could not be parsed (No address associated with hostname), which is consistent with what the team called "a problem with the domain." This means that the problem may lie at the DNS or domain registration level, rather than the on-chain contract being directly breached; the exact cause still needs to be explained by official forensic results. Why can the entire wallet be emptied with one authorization? For cross-chain bridge users, the most dangerous action is often not transfer, but "authorization". The moment the user presses confirmation on the front end, what really happens is that the permission to use a certain token is given to a set of contract addresses. If the website is replaced with an attacker-controlled version at this moment, the signature window that pops up in the wallet will be the same as usual. It will be difficult for the user to tell from the interface that what he is signing is handing over the entire transfer permission. This type of technique, called a wallet drainer, does not require a private key or cracking the wallet itself. As long as the authorization is obtained once, the assets can be swept away at any time. The serial theft of iOS self-managed wallets, which was only exposed on November 5 and was warned by GoPlus, led to a loss of approximately US$561,000 according to the security alliance SEAL. It followed the same path. For users, the order of remediation is clear: first check recently signed authorizations, revoke unrecognized contracts, and then only enter through officially verified entrances. The old problem of cross-chain bridge, this time the entrance has been changed. The major losses of cross-chain bridge in the past few years almost all occurred at the contract layer. The Ronin cross-chain bridge was breached in 2022, writing one of the largest thefts in DeFi history, and the protocol was subsequently released again; in May this year, the Verus Ethereum cross-chain bridge was attacked, and Blockaid monitored losses of more than $11.58 million. If the contract is breached, at least it will leave traces on the chain, and it will also provide a clear direction for strengthening the audit and multi-signature mechanisms. If something happens to the front end or the domain this time, the attack surface will move from the smart contract to "the web page opened by the user." For the bridge, the domain registrar, DNS provider, CDN and front-end deployment chain have all become risks that must be managed, and these links have rarely been included in the scope of smart contract audits in the past. The incident of Vercel being hacked this year, which also caused encryption developers to urgently change API keys, is a warning sign in the same supply chain. The timing was not good for Across itself. The agreement had previously proposed the idea of ​​restructuring the DAO into an entity company, allowing tokens to be exchanged for equity or redeemed at a premium at a ratio of 1:1, and was preparing to move the governance structure closer to the institutional market. If it is confirmed that the network domain or front-end is lost at this time, investors' questions about its operating discipline will be more difficult to answer than technical questions. The value of a cross-chain bridge is based on the trust of "handing the asset to it for a few minutes." Once trust needs to be repaired by forensic reports, the recovery period is often measured in quarters. Follow-up observations There are four things to keep an eye on: whether the official forensic report confirms DNS hijacking or domain provider level changes, whether the actual total loss on the chain exceeds the number currently spoken by users, whether other DeFi front-ends were affected during the same period, and whether Across will suspend the bridge contract to stop the bleeding. Before the official conclusion is given, "don't open, don't connect, don't sign" is still the only safe operation. Related reports: Vercel was hacked, encryption developers urgently changed API keys: AI tool Context.ai became a vulnerability, Web3 front-end supply chain raised an alarm, GoPlus warned: iOS self-managed wallets were stolen repeatedly! SEAL reported a loss of approximately US$561,000, and Trust Wallet was mostly the victim. The largest theft in DeFi history. The Ronin cross-chain bridge "contracted again" to plunder assets without multiple signatures, but now there is a turning point. Across cross-chain bridge is suspected of being hacked! Officials urgently called for deactivation and wallets were stolen. This article was first published in BlockTempo, the most influential blockchain news media.