Across Protocol Urges Users to Skip App After Wallet Draining Reports

Crosschain bridging protocol Across has urged users to stop interacting with its app and avoid signing any transactions or approvals while the team investigates a suspected security incident, according to a post on X. The warning did not specify what was compromised, but it was clear in its instruction: users should not connect wallets or approve actions until further notice.

The alert comes amid multiple user-reported losses tied to bridge interactions. While Across has asked for transaction details to investigate, Cointelegraph notes that it has not independently verified the claims, and Across had not immediately responded to requests for further information at the time of writing.

Key takeaways

• Across instructed users to refrain from accessing its app and from signing transactions or approvals during an ongoing investigation.
• Multiple users reported losses in stablecoins, alleging wallet drainage or compromised website activity after using the bridge.
• Across asked for investigation details, requesting transaction information from affected users.
• No confirmed attack mechanism was disclosed in the warning, leaving the exact cause and scope unclear.

Across pauses app access as investigation begins

On Tuesday, Across posted a security warning to its X account advising users not to access its application or connect their wallets. In the same message, the protocol asked users to avoid signing any transactions or approvals “until further notice,” without offering further specifics about the incident.

That lack of detail is important for users and integrators alike. In many crypto incidents, the risk can be either operational (for example, a front-end compromise) or smart-contract-related. Across did not clarify which category it believes the issue falls into, which means users should treat any wallet approval—whether for approvals, swaps, or bridge calls—as potentially risky until the protocol provides more information.

User reports of stablecoin losses raise questions

Following Across’s warning, several users took to X to describe what they alleged happened after using the bridge.

One user claimed they lost $9,000 in USDC. Another reported losing 7,053 USDT0 across seven transactions on the Plasma blockchain. A separate account alleged that their wallet was drained after using the bridge multiple times, stating that the website had been compromised.

Across responded by asking these users to share transaction details so the team could investigate the reports. However, Cointelegraph emphasized that it did not independently verify the claims, and the protocol had not immediately provided additional details about what, if anything, was altered in its app or underlying infrastructure.

This gap matters: user-reported losses can reflect a range of scenarios, including phishing links, malicious approvals, compromised wallet connections, or interaction with altered front-end logic. Until Across (or independent security researchers) confirm the underlying issue, the most practical takeaway for users is to pause bridge activity and avoid signing new approvals connected to the protocol.

What remains unknown about the Across incident

Across’s public warning did not explain whether it believes the incident involved its website, its wallet-connection flow, its smart contracts, or another component of its ecosystem. It also did not state whether the issue affected specific networks, contract routes, or time windows.

Because wallet signatures are often permissioned through approvals, a key uncertainty is whether affected users granted approvals that later allowed unauthorized spending. In cases where front-end compromise is suspected, attackers may attempt to trick users into signing transactions that redirect funds rather than executing the intended bridge action.

For now, Across’s request for transaction details suggests the team is trying to correlate on-chain activity with user reports. Investors and traders should also note that such investigations can take time and may result in follow-up updates ranging from targeted mitigations to broader incident reports—especially if multiple users report similar outcomes.

Unrelated security breach also hits NEAR AI

Separately from the Across warning, NEAR AI disclosed a different security incident on Monday. The company said attackers exploited a vulnerability in its AI infrastructure and exposed account details belonging to approximately 100 users, along with data from 18 AI agents.

According to an incident report dated Nov. 9, the attackers took advantage of a remote code execution (RCE) vulnerability in SGLang, an open-source AI inference engine. NEAR AI said the compromise enabled access to an internal server and other infrastructure. The exposed information included user names, email addresses, agent chat histories, settings, and logs, and NEAR AI said two customers had API keys exposed.

NEAR AI also stated that attackers may have observed requests processed on the compromised server, including requests handled in confidential mode. The company said it patched the vulnerability, revoked exposed credentials, and restored access to its cloud services.

While this NEAR AI incident is not directly connected to Across, it underscores how both crypto and adjacent on-chain ecosystems remain exposed to security flaws—whether in blockchain tooling or in the software used to power user-facing services.

For Across users, the immediate priority is clear: keep wallets unconnected and avoid signing any new transactions tied to the bridge until the protocol provides further clarification. What to watch next is whether Across follows up with a concrete root cause, scope details (which routes or contracts were impacted), and any remediation steps for potentially affected approvals or sessions.