User Loses $305,000 After Across Protocol Website Hijack

An investor lost approximately $305,000 in Aave deposit tokens during an attack on the Across Protocol website on November 10. The incident occurred after the platform's domain was hijacked through social engineering involving the registrar Namecheap.

Investigations by Bitquery point to a total loss reaching $401,900 distributed across nine distinct wallets. The criminals used a compromised interface to request spending permissions from users. This action exposed lending positions held outside of the transfer bridge.

The attack focused specifically on aWETH tokens that represent deposits in Aave. The fake site requested a signed authorization that allowed the attackers to move the victim's assets. The initial transaction recorded an unlimited approval followed by immediate transfers to the attackers' wallets.

Although the owner revoked the spending permission minutes after the withdrawals, the assets had already been drained. The amount stolen from the largest wallet represents approximately 76% of the total value identified by the Bitquery analysis. The case highlights the operational risks in decentralized protocol interfaces.