A user of the decentralized lending platform Aave lost approximately $305,000 in a deposit token after the website of cross-chain bridge Across Protocol was hijacked on November 10. According to a Bitquery investigation, the loss was linked to spending permissions requested through the compromised interface, exposing a lending position held outside the bridge.
Review Highlights
- A user of Aave lost $305,000 in a deposit token after the Across Protocol website was hijacked on November 10.
- Bitquery estimates $401,900 in losses across nine wallets linked to the Across website hijack.
- Across Protocol has pledged to reimburse affected users after its domain was restored.
Across Protocol Website Hijack Details
The hijack of the Across Protocol website occurred on November 10, with the attackers using social engineering to take over the domain through the registrar Namecheap. The compromised interface was used to request spending permissions, which were then used to move the depositor's tokens.
The first transfer transaction recorded an unlimited approval followed by about 115.23 aWETH sent to one wallet and 28.81 aWETH to another. Bitquery identifies those recipients as the attacker's wallet and the drainer's fee wallet, respectively.
Aave Deposit Token Loss
The Aave deposit token lost by the user was an interest-bearing token representing an Aave deposit. Aave's documentation explains that its deposit tokens can be transferred and that a signed permit can authorize another account to spend them.
The depositor's transfer history shows four pulls ending three minutes after the first. Bitquery says the owner revoked the approval a minute after the last pull, but the transfers had already happened by that point.
Bitquery Investigation
Bitquery's investigation estimates $401,900 in losses across nine wallets linked to the Across website hijack. The Aave depositor accounts for about 76% of the traced losses.
The update adds a previously missed ether sweep, and Bitquery links the loss to spending permissions requested through the compromised interface, exposing a lending position held outside the bridge.
Across Protocol's Response
Across Protocol has pledged to reimburse affected users after its domain was restored. The company's domain was taken over through social engineering involving its registrar, Namecheap.
The incident highlights the importance of security measures in the cryptocurrency space, particularly for cross-chain bridges and decentralized lending platforms.
Common Buyer Questions
What happened to the Across Protocol website?
The website was hijacked on November 10 through social engineering involving the registrar Namecheap.
How much was lost by the Aave user?
Approximately $305,000 in a deposit token.
Have a news tip, press statement, or correction request? Reach the DealMav Newsroom or review our Editorial Standards & Corrections Policy.
Leave a Reply