New blockchain investigations have uncovered additional losses from the Across Protocol domain hijacking and traced more than $2.2 million stolen from Arcus Perps. In today’s crypto security roundup, Bitquery has raised its estimate of the Across attack to approximately $402,000 after identifying a previously missed Ethereum withdrawal. Separately, PublicAML found that the Arcus exploiter moved stolen USDG from Robinhood Chain to Ethereum before the exchange blocked the known attacker address. Both investigations provide new details about incidents that occurred earlier this week, while the affected platforms report different progress on customer compensation and asset recovery.
Across Protocol hack losses revised upward to $402,000
Blockchain analytics firm Bitquery has revised its estimate of losses from the November 10 Across Protocol domain hijacking to $401,900, up from approximately $348,000 in its original investigation published November 11.
The November 12 update identifies an additional 26.38 ETH, worth roughly $54,000 at the time, withdrawn from a victim’s smart wallet through a mechanism that differed from the token-draining transactions initially investigated.
Across Protocol’s official website, across.to, was compromised at approximately 18:45 UTC on November 10 after an attacker reportedly used social engineering against domain registrar Namecheap to gain control of the domain.
The attacker redirected visitors to a counterfeit version of the bridge’s website that requested malicious wallet permissions. Across said its blockchain contracts were not compromised, and that API users and third-party integrations were unaffected.
The domain was right, but the page behind it wasn’t, and that made the trap harder to spot.
Bitquery traced unauthorized transfers from nine wallets across Ethereum, Arbitrum, Base, BNB Chain and Optimism between 19:02 and 21:53 UTC. The updated estimate values tokens at their prices when withdrawn and excludes assets for which reliable market prices were unavailable.
The newly identified ETH withdrawal occurred at approximately 19:56 UTC. Investigators found that the victim’s smart wallet transferred the funds to a collector address, which retained 5% before forwarding the balance to another wallet. Roughly ten minutes later, that intermediary sent 20.95 ETH to the principal attacker address.
Bitquery linked the transfer to the Across incident through the wallet’s earlier losses, transaction timing and connections with addresses involved in the other drains. The revised amount represents newly identified losses from the same attack, not evidence of another compromise.
The incident differs from the counterfeit domains described in DaveFinances’ earlier investigation into fake OnRe and OKX websites targeting cryptocurrency users. Those websites impersonated legitimate platforms using unrelated domains, while the Across attacker temporarily controlled the project’s actual web address.
One Aave depositor accounts for 76% of Across losses
Bitquery’s investigation found that a single Aave depositor lost approximately $305,000, accounting for 76% of the revised Across loss estimate.
One victim, really, carried most of the financial damage.
The wallet held approximately 148.60 aWETH, representing an interest-bearing Ethereum deposit. According to Bitquery, the victim signed a malicious permit that allowed the attacker to transfer the tokens without requiring a conventional on-chain approval transaction at the moment of signing.
The attacker subsequently drained the deposit through four transfers over approximately three minutes. The wallet owner revoked the authorization shortly afterward, but the tokens had already been moved.
The FBI has previously documented how malicious websites can drain connected cryptocurrency wallets, including through fraudulent interactions that lead users to grant attackers access to their assets.
Bitquery also identified an unusually precise revenue-sharing arrangement in the Across theft. Each token drain divided the proceeds between two addresses, with 80% going to the primary attacker wallet and 20% to a second address believed to belong to the operator of the wallet-draining software.
The fee wallet had been active since September 25 and had collected payments associated with approximately 290 drained Ethereum wallets before the Across investigation. The pattern is consistent with a wallet-drainer service rented to multiple operators, although blockchain records do not establish the identities of those involved.
Investigators also challenged an earlier estimate of $294,000 that circulated after the incident. That figure closely matched the balance of the 20% fee wallet, but at least $167,000 of its holdings predated the Across attack.
So the $294,000 figure, it was not a reliable count of what Across users lost.
After consolidating the stolen ETH, the attacker moved proceeds through several blockchains. Approximately $101,000 was traced into XMR1, a Monero-linked token on Hyperliquid. Another roughly $100,000 moved through Chainflip to Solana and eventually reached an address Bitquery associates with online casino Rainbet.
That casino attribution is based on wallet behavior and Bitquery’s address labels, not an independently confirmed identification of the account holder. Investigators seperately traced approximately $96,000 into 1.305 BTC through THORChain.
Across confirmed on November 11 that it had regained control of its domain and restored normal operations. The protocol also promised to make all affected users whole, although it has not published a verified total of completed reimbursements.
The difference between tracing stolen assets and establishing actual recovery has also featured in DaveFinances’ coverage of the Keplr wallet security incident. That case involved exposed wallet keys rather than malicious website permissions, but both investigations illustrate why the location of funds alone cannot establish how much customers have recieved back.
Arcus exploiter moved $2.23 million before address block
A separate November 11 investigation by blockchain tracing service PublicAML has reconstructed how the attacker behind the Arcus Perps exploit transferred approximately $2.23 million from Robinhood Chain into Ethereum before the platform restricted the known attacker address.
The Arcus incident began at approximately 03:07 UTC on November 10, when an attacker exploited an accounting vulnerability involving transfers between trading subaccounts.
According to Arcus’s incident report, the vulnerability allowed a newly created account to record a substantially larger balance than it actually held. The attacker then used the inflated balance to withdraw 2,234,391 USDG, a dollar-denominated stablecoin issued by Paxos.
The attacker attempted to withdraw another approximately $3 million, but those requests were stopped by the bridge’s rate-limiting controls and later reversed. The additional $3 million was therefore not part of the confirmed stolen amount.
Arcus paused withdrawals at 04:07 UTC, deployed a fix at 04:37 UTC and blocked the attacker’s addresses at 04:43 UTC.
PublicAML found that the exploiter had already transferred virtually the entire stolen amount to Ethereum using Relay.link. Between 03:13 and 03:59 UTC, the attacker submitted nine bridge requests, seven of which completed successfully after two initial requests were refunded and resubmitted.
The completed transfers delivered approximately 1,052.2 ETH to the attacker’s Ethereum address.
The stablecoins were gone from Robinhood Chain before the block arrived, and quickly too.
The final successful bridge transfer occurred 44 minutes before Arcus blocked the known address. Converting USDG into ETH also changed the potential recovery options, since USDG is issued by an entity capable of restricting its token, while native ETH has no equivalent issuer-controlled freeze mechanism.
The incident follows another bridge-related vulnerability examined in DaveFinances’ report on the $304,500 Ankr bridge exploit. In that case, unauthorized withdrawals relied on forged cross-chain receipts carrying valid signatures. Arcus’s vulnerability instead originated in internal balance accounting, with cross-chain infrastructure subsequently used to move the stolen assets.
Arcus covers customer losses as stolen assets remain outstanding
PublicAML found that the Arcus attacker subsequently divided the converted ETH across several assets and wallets.
By the investigation’s November 11 cutoff, approximately 475.06 ETH remained at the original exploiter address on Ethereum. Another portion had been converted through CoW Protocol into 1,008,945 DAI, which was transferred to a newly created Ethereum wallet.
Approximately 101 ETH was converted into Bitcoin using THORChain and Relay.link, resulting in 2.831 BTC held at a separate Bitcoin address.
PublicAML reported no identified transfers of these holdings to centralized exchanges or cryptocurrency mixers as of its investigation cutoff. Those findings are a dated snapshot rather than confirmation that the assets have remained stationary since November 11.
Arcus Labs had already covered the 2,234,391 USDG shortfall using its company treasury on November 10. The company said customer balances, positions and orders were unaffected, and normal trading and withdrawals resumed following the security response.
The customers got covered, but the stolen assets themselves did not come back.
The treasury replenishment represents compensation for the loss rather than recovery of the withdrawn USDG. Unless the attacker returns the assets or they are otherwise recovered, the economic cost remains with Arcus Labs.
On-chain messages purporting to represent Arcus also offered the exploiter a 10% white-hat bounty for returning approximately 90% of the stolen funds by November 13 at 01:00 UTC. The proposed return was approximately $2.01 million, leaving roughly $223,000 as a potential reward.
The authenticity of those messages has not been independently established in the available investigation, and the offer was not included in Arcus’s original incident report. No confirmed repayment under the proposed arrangement was documented at the November 11 tracing cutoff.
The two investigations highlight different failures with different outcomes. Across’s compromised website induced malicious wallet authorizations despite the bridge contracts remaining operational, while Arcus’s internal accounting flaw permitted withdrawals that were then moved through otherwise functioning cross-chain services.
Across has made a public reimbursement committment but has not disclosed completed compensation figures. Arcus has already absorbed its customer’s shortfall, while approximately $2.23 million in withdrawn assets remained under attacker control in the latest verified forensic snapshot.
The next relevent evidence will be Across’s promised post-mortem and confirmed reimbursement accounting, together with any independently verified recovery of the Arcus funds.
Johan Shamshad is Editor-in-Chief at Dave Finances, covering financial markets, digital assets, trading platforms, brokers, fintech, payments and regulation. Since 2023, he has also worked as an editor at Gulf News, the UAE English-language newspaper published by Al Nisr Publishing LLC. His work focuses on market-moving developments, company disclosures, regulatory changes and trading infrastructure, with an emphasis on primary-source verification and practical context for traders and investors.