Across warns users after reports of wallet-draining losses

Across Protocol warned users Tuesday, Nov. 10, not to access its app, connect their wallets or sign transactions while it investigates a potential security incident. The warning followed reports of alleged losses involving USDC and USDT0.

The crosschain bridging protocol advised users not to approve transactions until further notice. Across did not disclose the nature of the incident or confirm whether its website had been compromised.

One user claimed to have lost $9,000 in USDC. Another reported losing 7,053 USDT0 in seven transactions on the Plasma blockchain. A third user alleged that their wallet was drained after using the bridge several times and suggested the website may have been compromised.

Across asked users who reported losses to provide transaction details. The claims have not been independently verified, and the protocol has not provided further details.

Across allows users to transfer digital assets between Ethereum and other blockchain networks. Wallet connections, transaction signatures and token approvals can allow smart contracts to move assets from a user’s wallet.

In a separate incident disclosed Monday, Nov. 9, NEAR AI reported that attackers exploited a remote code execution vulnerability in SGLang, an open-source AI inference engine. The attackers used the vulnerability to access an internal server and other infrastructure.

The breach exposed account information for about 100 users and data from 18 AI agents. The exposed information included names, email addresses, agent chat histories, settings and logs. API keys belonging to two customers were also exposed.

NEAR AI reported that attackers may have observed requests processed on the compromised server, including requests made in confidential mode. The company patched the vulnerability, revoked exposed credentials and restored access to its cloud services.

Reviewed and fact-checked by Alex Panasenko on November 11.