Across, a cross-chain bridge that moves tokens between blockchains, said on X at 01:16 UTC on Wednesday that it was “fully restored, and all systems are operational,” after an attacker took control of its across.to domain on Tuesday and pointed visitors to a phishing page.

The post came about six and a half hours after the start of the attack, which the protocol put at roughly 18:45 UTC on Nov. 10.

Blockchain security firm GoPlus Security estimated user losses at $350,000, spread over Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma. Across has not confirmed that number in its posts.

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

How the Takeover Happened

Across said late Tuesday in a post on X that “a social engineering attack on @Namecheap (our domain registrar) gave a bad actor control of the Across domain,” and that “despite our best efforts, @Namecheap has been unresponsive.” Its domain “was fully locked down with best-in-class security practices; this unauthorized takeover should not have been possible,” Across said, promising a post-mortem.

The team said it learned of the attack within 15 minutes and moved to take the site offline, while SEAL911 (a crypto security emergency hotline) flagged the address to major wallets as a phishing site and Cloudflare helped Across label the domain as risky, then stripped the domain’s Domain Name System (DNS) records, the entries that point a web address to a server.

Losses and Next Steps

According to GoPlus, the fake page got users to sign token approvals, which the attacker then used to pull funds. They included EIP-2612 permits, an Ethereum Improvement Proposal (EIP) standard that grants spending rights through an offchain signature, and authorizations for Permit2, a widely used token-approval contract that lets a single signature authorize transfers from a wallet.

Visitors who reached across.to before Cloudflare shut the site off completely “may have been affected,” Across said, adding that third-party integrations and developers using its application programming interface (API) were not. It asked anyone hit to message it with transaction details and to revoke any permissions granted to the attacker.

In its restore post, Across thanked Namecheap’s founder Richard Kirkendall “for responding on X, helping us secure our account” and opening an investigation, and said: “All affected users will be made whole.” It said a full post-mortem would follow “in the coming days.” Across hasn’t explained how the attacker talked their way into its Namecheap account; it said the post-mortem would cover how the takeover was possible.

Related Listen: Why a Nation State Will Always Beat the Security of a DeFi Team