Aave user loses $305,000 in Across Protocol website hijack
In this article
A user who had supplied assets to Aave lost about 148.60 aWETH, valued at roughly $305,000, after signing a spending permit on the fraudulent page that replaced Across Protocol’s across.to domain on Nov. 10, according to an investigation by on-chain analytics firm Bitquery that was updated on Nov. 12 and reported by Cryptoslate. Across itself first disclosed the takeover in posts on X, attributing it to social engineering aimed at its domain registrar, Namecheap, and said its domain was back under its control on Nov. 11.
How a signed permit reached an Aave deposit
The stolen asset was aWETH, an interest-bearing token that represents an Aave deposit. Aave’s documentation, cited by Bitquery, notes that these tokens can be transferred and that a permit message can authorise another account to spend them. In Bitquery’s reconstruction, the fake Across page requested such a permit, and the attacker used it to pull the tokens.
The first transaction bundled the approval and two token transfers. Three more pulls followed over the next three minutes, bringing the Aave-related loss to about $304,500 at theft-time prices — 76% of the traced total — before the approval was revoked. Revoking a permission stops later transfers but does not undo ones already recorded on-chain, which is why the depositor’s funds had already moved.
Bitquery also added a previously missed sweep of 26.38 ETH, about $54,000 at the time, from a separate victim, and said the widely circulated $294,000 figure matched holdings in the fee wallet, including funds that predated the attack.
The reports do not agree on the total
The available accounts differ in both scope and number. Bitquery’s Nov. 12 update puts the total at $401,900 across nine wallets and five chains; GoPlus, as reported by crypto.news, estimated nearly $350,000 across six networks, adding Ink and Plasma. Cointelegraph’s Nov. 11 report noted that Across had not yet disclosed its own confirmed loss figure or the number of affected users.
Across has said the incident came from a registrar compromise rather than its smart contracts: the attacker redirected visitors to a phishing page, and third-party integrations and API users were unaffected. GoPlus, as reported by crypto.news, said victims were likely persuaded to sign EIP-2612 permits, Permit2 authorisations or direct token approvals.
Why it matters
The loss shows that a domain-level compromise can cost more than the bridge itself: the largest traced victim never moved assets through Across but was exposed through a transferable lending token. That widens the blast radius of website hijacks across DeFi, where tokenised and yield-bearing assets increasingly sit in wallets that interact with third-party front ends.
The incident also follows other website-level attacks in DeFi, including the October hijackings tracked through the Step Drainer toolkit, underlining how much of user risk now sits at the interface rather than the contract.
What to watch
Across has said it will publish a full post-mortem explaining how the attacker gained control, and its compensation pledge is the concrete next item for affected users. The final tally may also shift if Bitquery or GoPlus revise their traces, and victims have been directed to check approvals on Revoke.cash in the meantime.
Market snapshot
At 03:16 UTC on Nov. 13, Aave (AAVE) traded at $112 (₹10,568), down 5.5% over 24 hours and 14.2% over seven days, with a market cap of $1.73 billion and 24-hour volume of $153.9 million, per CoinPaprika data. Ethereum (ETH) changed hands at $1,981 (₹186,288), down 3.5% on the day and 11.2% on the week.
Sources: CryptoSlate, Cointelegraph, crypto.news
