Aave user loses $305,000 in Across Protocol website hijack

BitcoinWorld

Aave user loses $305,000 in Across Protocol website hijack

A user who had supplied assets to Aave lost about 148.60 aWETH, valued at roughly $305,000, after signing a spending permit on the fraudulent page that replaced Across Protocol’s across.to domain on Nov. 10, according to an investigation by on-chain analytics firm Bitquery that was updated on Nov. 12 and reported by Cryptoslate. Across itself first disclosed the takeover in posts on X, attributing it to social engineering aimed at its domain registrar, Namecheap, and said its domain was back under its control on Nov. 11.

Key facts

• Bitquery’s Nov. 12 update estimates $401,900 taken from nine wallets on Ethereum, Arbitrum, Base, BNB Chain and Optimism during the Nov. 10 hijack of across.to.
• At 20:09:23 UTC on Nov. 10, an Ethereum transaction recorded an unlimited approval from wallet 0x42e7…483c, then sent about 115.23 aWETH to 0x2846…1fde and 28.81 aWETH to 0x0c7c…d37b, an 80/20 split Bitquery attributes to the attacker and a drainer fee wallet.
• The depositor’s transfer history shows four pulls ending by 20:12:23 UTC, and Bitquery says the owner revoked the approval a minute after the last one.
• Across told users its domain was restored on Nov. 11 with help from Namecheap founder Richard Kirkendall, and Cointelegraph reported the team pledged that all affected users would be made whole with a post-mortem to follow.
• Security firm GoPlus estimated losses of nearly $350,000 across six blockchain networks, crypto.news reported, listing Ethereum, Arbitrum, Base, BNB Chain, Ink and Plasma.

How a signed permit reached an Aave deposit

The stolen asset was aWETH, an interest-bearing token that represents an Aave deposit. Aave’s documentation, cited by Bitquery, notes that these tokens can be transferred and that a permit message can authorise another account to spend them. In Bitquery’s reconstruction, the fake Across page requested such a permit, and the attacker used it to pull the tokens.

The first transaction bundled the approval and two token transfers. Three more pulls followed over the next three minutes, bringing the Aave-related loss to about $304,500 at theft-time prices — 76% of the traced total — before the approval was revoked. Revoking a permission stops later transfers but does not undo ones already recorded on-chain, which is why the depositor’s funds had already moved.

Bitquery also added a previously missed sweep of 26.38 ETH, about $54,000 at the time, from a separate victim, and said the widely circulated $294,000 figure matched holdings in the fee wallet, including funds that predated the attack.

The reports do not agree on the total

The available accounts differ in both scope and number. Bitquery’s Nov. 12 update puts the total at $401,900 across nine wallets and five chains; GoPlus, as reported by crypto.news, estimated nearly $350,000 across six networks, adding Ink and Plasma. Cointelegraph’s Nov. 11 report noted that Across had not yet disclosed its own confirmed loss figure or the number of affected users.

Across has said the incident came from a registrar compromise rather than its smart contracts: the attacker redirected visitors to a phishing page, and third-party integrations and API users were unaffected. GoPlus, as reported by crypto.news, said victims were likely persuaded to sign EIP-2612 permits, Permit2 authorisations or direct token approvals.

Why it matters

The loss shows that a domain-level compromise can cost more than the bridge itself: the largest traced victim never moved assets through Across but was exposed through a transferable lending token. That widens the blast radius of website hijacks across DeFi, where tokenised and yield-bearing assets increasingly sit in wallets that interact with third-party front ends.

The incident also follows other website-level attacks in DeFi, including the October hijackings tracked through the Step Drainer toolkit, underlining how much of user risk now sits at the interface rather than the contract.

What to watch

Across has said it will publish a full post-mortem explaining how the attacker gained control, and its compensation pledge is the concrete next item for affected users. The final tally may also shift if Bitquery or GoPlus revise their traces, and victims have been directed to check approvals on Revoke.cash in the meantime.

Market snapshot

At 03:16 UTC on Nov. 13, Aave (AAVE) traded at $112 (₹10,568), down 5.5% over 24 hours and 14.2% over seven days, with a market cap of $1.73 billion and 24-hour volume of $153.9 million, per CoinPaprika data. Ethereum (ETH) changed hands at $1,981 (₹186,288), down 3.5% on the day and 11.2% on the week.

This post Aave user loses $305,000 in Across Protocol website hijack first appeared on BitcoinWorld.