Crypto With Block

Daily News

Across Site Hijacked: What to Check Tonight

Across Protocol's website was replaced with a phishing page. Here is what to check, plus the other crypto security stories and market news from today.

November 11, 2026 · 6 min read

Fake site, real losses

A real crypto website was swapped for a fake one. In the next few minutes you'll know whether that could touch your wallet, and the one habit that blunts it. This is Crypto With Block Daily. Five security stories today, and three of them need action from you. Then the market, and a big move from the banks.

First, Across Protocol, a cross-chain bridge. Cointelegraph reports that Across said a social engineering attack on its domain registrar, Namecheap, let an attacker take over its web address on Tuesday, around six forty-five p.m.

U.T.C. The real site was replaced with a phishing page.

Across said it was alerted within fifteen minutes and shut the site down. The security group SEAL nine one one flagged the domain as phishing with major wallets, and Cloudflare removed its D.N.S. records.

Across says some people who visited before the block may have been affected. Third-party integrations and A.P.I. users were not.

How much was lost? Across has not disclosed total losses or the number of users affected. On Wednesday it said the domain is back under its control, affected users will be made whole, and a full post-mortem is coming.

If you used the Across site on Tuesday evening, check your recent wallet activity and token approvals, and revoke any you don't recognise.

Bookmark the real site

The doors around the code

That was the habit I promised: bookmark the sites where you move money, and don't reach them through links. Notice the pattern today.

The doors around the code

The protocol's code wasn't the weak spot. A registrar, a cloud key, a vendor script. The doors around the code. Next, a hack that turned out bigger than first reported.

Second, Initia, a layer-one network. Initia now says about three point two seven million dollars was taken.

Cointelegraph reports Initia now says an attacker took about three point two seven million dollars after breaking into its cloud systems with a compromised Google Cloud key.

Initia said the attacker got in on Monday through a command injection attack, reached its GitHub and cloud accounts, and picked up more credentials.

Then, according to Initia, they validated fake withdrawals from five rollups and emptied escrow accounts. About two point one six million dollars remains frozen on the halted network, and Initia says it intends to restore the backing of affected assets.

Two exploits, two causes

This is Initia's second exploit in under three weeks. Cointelegraph reports the October twenty-third one, about two point seven million dollars, used a different flaw, in its script cache.

Two exploits, two causes

The network is halted, so there's nothing to click right now. If you hold assets on Initia, follow its official channels for updates, not replies or direct messages that promise help.

Third, Polymarket. Josh Stevens, Polymarket's engineering vice president, announced a withdrawal address allowlist on Monday, US time, according to Cryptopolitan. PANews reported it on November tenth.

You lock withdrawals to approved addresses. Adding a new one needs email confirmation and then a forty-eight hour wait.

Why now? On October twenty-ninth, Bitquery counted about two point seven three million dollars leaving seven hundred thirty-seven Polymarket accounts in an hour.

Researchers linked it to a site-speed script from a vendor, DebugBear, according to crypto dot news. Polymarket confirmed a compromised provider.

Stevens says the allowlist means that even if a session is stolen or you sign something malicious, funds can't go to an address you didn't approve.

Cryptopolitan notes it doesn't fix the vendor-script problem itself. If you use Polymarket, he recommends turning it on under Settings, then Account.

Limit where money can go

Patch, then rotate

Two quick ones now, for people who run their own servers or use certain services. Both are patch-and-rotate stories.

Fourth, LNbits, software for running Bitcoin Lightning wallets and payment pages.

Cointelegraph reports the project shipped version one point seven point zero on Tuesday, a critical security release, after attacks that led to stolen funds. LNbits says every earlier version is vulnerable.

If you run LNbits, update to one point seven point zero now. But LNbits warns that updating alone isn't enough if your credentials were already exposed.

Reset wallet keys, replace funding-source credentials, and treat secrets in your settings as compromised. It suggests a fresh server if you suspect a break-in.

Patching doesn't un-leak a secret

Fifth, NEAR AI. Decrypt reports, citing the company's November ninth incident report, that an attacker used a flaw in SGLang, open-source software that runs AI models, to get into internal systems. That updates our earlier note, which only had headlines.

About one hundred users had names and emails downloaded, some with plan and balance details. Data from eighteen older agents was taken, and two customers' cloud A.P.I. keys were exposed and revoked.

NEAR AI found no sign that stored Private Chat conversations were accessed, but says confidential-mode requests processed on November eighth may have been visible. It has notified confirmed victims and warns about unsolicited messages that mention your account. This was reported as an account-data breach, not a theft of crypto funds.

Ignore unsolicited account messages

The market check

Now the market. Bitcoin and most large coins slipped over the past day, and one coin fell much harder than the rest. Just the facts, and the reasons that were reported.

Markets today. According to CoinGecko, Bitcoin was trading just below seventy-three thousand dollars and Ethereum was also lower. The biggest notable mover was Zcash, near nine hundred eighty dollars, down about fourteen percent over twenty-four hours, per CoinGecko.

Zcash fell hardest

The reported reason for Bitcoin: Cointelegraph says it fell toward an eleven-week low after US October inflation came in at point four percent for the month, against point three expected.

Traders now price mostly a quarter-point Fed rate hike in December, about eighty-five percent odds, with about fifteen percent odds of a half-point hike, per CME FedWatch.

For Zcash, Seeking Alpha attributed the drop to liquidations of leveraged long bets, redemptions from Grayscale's Zcash trust, and selling after the N.U. seven network upgrade, which it says worked as intended.

Yahoo Finance notes Zcash is about forty-one percent below its September twenty-sixth closing high, but still up about eighty-nine percent this year.

One more fact. BlackRock's Bitcoin ETF, I.B.I.T., recorded a seventh straight day of outflows on Monday, about one point six six billion dollars since October thirtieth, according to Farside Investors data in Cointelegraph.

All US spot Bitcoin ETFs together shed two hundred one million dollars that day.

Banks and Washington

Two stories left, and neither needs action from you. One is about banks, one is about Washington.

Banks first.

Cointelegraph, citing Bloomberg, reports that Project Faro, a group of twenty-one financial institutions including Goldman Sachs, Citigroup and BBVA, has committed about two hundred seventy million dollars to launch a US dollar stablecoin in the first half of twenty twenty-seven.

It's a plan, not a product yet.

For scale, DefiLlama data cited in the article puts Tether's U.S.D.T. and Circle's U.S.D.C. at about eighty-five percent of a roughly two hundred ninety billion dollar stablecoin market. The article also notes some Faro banks back rival projects too, so this is an early race.

Washington. After Democrats won the midterms, House Republicans elected Tom Emmer, who helped found the Congressional Crypto Caucus, as minority whip, by a one hundred three to seventy-six vote, per Politico via Cointelegraph.

Democrats take control of the House in January, per the report. Senator Cynthia Lummis called Emmer one of the strongest advocates for digital assets.

Three checks for tonight

That's the day. Three things to take with you. Bookmark the sites where you move money, and don't reach them through links or ads. Switch on withdrawal allowlists where a service offers one. And if you run your own server, patch and rotate your keys, because a patch doesn't un-leak a secret.

Details may change

Across has promised a full post-mortem and Initia is still investigating, so details may change, and I'll update you when they do. Nothing here is financial advice.

Sources

Holding a lot? Lock it down: cryptowithblock.com/holders

Education only. Not financial advice.