Across Protocol Warns Users to Avoid App During Active Domain Investigation
Across Protocol issued an emergency warning on Nov. 10 to avoid its app amid a suspected domain compromise. EVM token approvals persist on-chain even after you disconnect, leaving anyone who's ever used the bridge potentially exposed.
Suspected domain compromise on a $40B+ bridge is a live reminder that EVM approvals don't expire when you disconnect.
Key takeaways
- Across Protocol, a cross-chain bridge with more than $40 billion in lifetime volume and 5 million wallets served, issued an emergency warning on November 10 urging users not to visit its app, connect wallets, or sign any transactions while it investigates a suspected domain compromise.
- Simply disconnecting your wallet does not revoke previously granted token approvals. Those on-chain permissions remain live until you explicitly revoke them via a separate transaction.
- Bitcoin's UTXO model has no equivalent approval mechanism. This class of attack has no analog on Bitcoin.
Across Protocol issued an emergency alert Tuesday afternoon telling users to stay off its app while it investigates an issue with its domain. The protocol has $40 billion in lifetime volume and more than 5 million wallets on record, meaning the exposure window, if the domain was in fact compromised, is wide.
The protocol posted on X at approximately 2:05 p.m. ET on November 10, 2026:
"🚨 ALERT 🚨 We're currently investigating an issue with the Across domain. Do NOT visit the app, connect your wallet, or sign any transaction or approval there until further notice. We will post updates as we have them." , @AcrossProtocol, November 10, 2026, ~2:05 p.m. ET
Across has not confirmed the nature or mechanism of the incident and has not specified whether the website itself was compromised. First reported by Cointelegraph.
What's Confirmed and What Isn't
Across has confirmed the investigation and asked users reporting losses to submit transaction details. Beyond that, the picture is still forming.
One user, @bilm01 on X, reported losing $9,000 in USDC. A second user reported losing 7,053 USDT0 across seven transactions on the Plasma blockchain. A third alleged the website itself was compromised after a wallet drain.
None of these reports have been verified by Across, and the protocol has not acknowledged a specific dollar figure for total losses. A figure of approximately $294,000 circulated on X via @SolanaFloor; that number is unconfirmed by Across and should be treated as unverified until the protocol issues a formal statement.
What is confirmed: Across has not issued any instruction telling users to revoke existing token approvals. That gap matters.
Disconnecting Is Not the Same as Revoking
Here is the mechanics problem every EVM user needs to understand right now. When you approve a DeFi protocol to move tokens on your behalf, that permission is written to the blockchain. It does not expire. It does not disappear when you close the browser tab, disconnect MetaMask, or even stop using the protocol entirely.
The only way to remove it is to submit a separate on-chain revocation transaction.
If a front-end or domain is compromised, an attacker who can serve a malicious interface to your browser can call on those standing approvals and drain the permitted tokens without you signing anything new. The earlier approval is the loaded gun. The compromised front-end is just the trigger.
This is not a novel attack vector. The Ledger reseller incident exposed the same surface. The Binance suspected hack demonstrated how fast funds move once an attacker has access. Front-end compromises follow a consistent pattern: the smart contracts are fine, the user's wallet is fine, and the funds disappear anyway because of permissions granted months or years earlier that nobody thought to clean up.
Bitcoin doesn't work this way. There is no ERC-20 approve() call, no standing permission slip, no contract with the right to sweep your balance on demand. Bitcoin's UTXO model requires a fresh signature for every spend.
What to Do Right Now
If you've ever connected a wallet to Across or any other EVM bridge and haven't audited your approvals recently, do it now. Use the Token Approvals tool on Etherscan (or the equivalent explorer for whatever network you used) to see every live approval attached to your address.
Each revocation requires a small gas fee and a separate on-chain transaction. It is tedious. It is worth it.
Watch Across's official X account for the all-clear and a formal incident report before returning to the app. Until Across confirms the nature of the issue and the status of its domain, treat any communication from that domain as potentially adversarial.
Sources
- @AcrossProtocol on X (official alert, November 10, 2026)
- Etherscan Token Approvals Tool
Frequently Asked Questions
If I used Across before but haven't touched it today, am I still at risk?
Yes, potentially. If you granted a token approval to Across at any point and never revoked it, that permission is still live on-chain. The date of your last visit is irrelevant. The approval persists until you explicitly revoke it with a separate on-chain transaction, regardless of whether you're connected to the app today.
How do I revoke token approvals from a protocol under investigation?
Go to the block explorer for the network you used (Etherscan for Ethereum mainnet, for example) and open the Token Approvals tool under your wallet address. It will show every active approval and let you revoke them individually. Each revocation costs a small gas fee and must be submitted as its own transaction. Revoking approvals on every chain you've used requires checking each chain's explorer separately.
Is this a smart contract hack or a front-end compromise?
Based on Across's own language, the issue appears to be at the domain or front-end level, not the smart contract level. Across said it is "investigating an issue with the Across domain," not a vulnerability in its contracts. That distinction matters for assessing contract-level risk, but it does not eliminate risk for users with standing token approvals. A compromised front-end can still use on-chain permissions you granted previously.
