Oof: a big wallet got wiped

A depositor using Aave lost around $305,000 after someone hijacked a cross-chain bridge site linked to Across Protocol. According to a Bitquery investigation updated on Nov. 12, the whole mess traces back to a fake version of the site that convinced a victim to sign off on something they really shouldn’t have.

What Bitquery found (and why the numbers aren’t small)

Bitquery says the compromised interface helped authorize token spending through an “unlimited” approval mechanism. In its revised trace, the investigation estimates roughly $401,900 was pulled from nine wallets across five blockchains, using asset prices at the time of the theft. The Aave depositor caught the biggest share—about 76% of the tracked losses.

Across Protocol says the domain was taken over

Across Protocol claims its domain was taken over on Nov. 10 via social engineering. The attacker allegedly leaned on the registrar, Namecheap, to make things go from “website” to “trap.” Classic move. Sneaky and boring—like a horror movie, but for your wallet.

The token at the center: aWETH

The largest stolen chunk was aWETH, which is basically an interest-bearing version of ETH tied to Aave deposits. Here’s the key detail: Aave deposit tokens can be moved, and they support signed permissions (permits) that let someone else spend them on your behalf.

How the attack likely worked

Bitquery’s reconstruction suggests the fake site requested a permit. Then the attacker used that permission to shuffle the victim’s tokens. And once that spending authorization existed, it opened the door to draining a separate lending position that wasn’t “on the bridge” but was still connected enough to be targeted.

The first transaction: approval first, draining right after

The first transfer on Nov. 10 shows the pattern you never want to see: an unlimited approval followed by transfers. Bitquery points to around 115.23 aWETH sent to one wallet (the attacker) and about 28.81 aWETH sent to another wallet (the fee collector). Bitquery also says this matches an 80/20 style split.

More pulls followed—and the revocation came too late

The depositor’s token history shows four pulls, all happening within minutes of the first transfer. Bitquery reports the owner revoked the approval about a minute after the last pull, but the damage was already done—because revoking permissions doesn’t rewind time. It just stops future chaos.

Bitquery’s “Catalyst” additions

Bitquery also mentions a separate sweep: an additional 26.38 ETH taken from another victim on Nov. 10. That was valued at about $54,000 at the time. This update also helps explain why earlier widely shared totals (like the $294,000 figure) don’t line up—because some prior numbers may have mixed in funds held by the fee wallet before the Across incident.

Can we prove which website was visited?

There’s a frustrating limitation here. Blockchain data doesn’t record the website a victim actually clicked, and it can’t reveal the off-chain timing of a signature. Bitquery basically has to infer the connection based on when events happened and which wallet addresses received the funds. So, it’s a strong reconstruction—but not a perfect “here’s the exact browser click” smoking gun.

Across says it’s back—promises refunds and a postmortem

On Nov. 11, Across Protocol said its domain was back under its control and promised to make affected users whole. It also vowed to publish a postmortem, which is corporate-speak for “we’re going to explain what happened, even though you already feel like you got mugged.”

Takeaway: permissions are powerful (and dangerous)

If there’s one lesson here, it’s that signed permissions over transferable deposit tokens can be the difference between “all good” and “why is my wallet on fire.” Always double-check what a site is asking you to approve—especially when domains and interfaces don’t look trustworthy.