Three cryptocurrency security incidents have produced new findings. Bitquery raised its estimate of losses from the Across Protocol domain hijack to $401,900 after identifying an additional Ethereum drain, Rujira disclosed a $200,000 exploit involving its BTC/USDC liquidity strategy, and blockchain investigators traced how an Arcus attacker moved $2.23 million off Robinhood Chain before being blocked. The latest crypto security roundup examines the attack mechanisms, movements of stolen funds and the recovery commitments made by the affected protocols.
Across Protocol losses rise to $401,900 after new Ethereum discovery
Blockchain analytics firm Bitquery revised its estimate of losses from the November 10 Across Protocol domain hijack to approximately $401,900 on November 12, up from the $348,000 reported in its initial investigation a day earlier.
The increase followed the discovery of a seperate transaction involving 26.38 ETH, worth approximately $54,000 at the time, that had escaped the original analysis because it used a different draining mechanism.
The attacker gained control of across.to through a social-engineering attack involving domain registrar Namecheap at approximately 18:45 UTC on November 10. Visitors were redirected to a counterfeit version of the cryptocurrency bridge’s website that requested malicious wallet authorizations.
The address was the right one, the destination was not.
The compromise lasted approximately three hours. Across subsequently regained control of its domain and said its underlying smart contracts, third-party integrations and API users were unaffected.
The incident illustrates a risk described in the Australian government’s Domain Name System security guidance: attackers who compromise domain registration controls can redirect visitors to malicious websites without taking over the legitimate application’s underlying infrastructure.
Bitquery’s updated investigation traced nine affected wallets across Ethereum, Arbitrum, Base, BNB Chain and Optimism. One Aave depositor accounted for approximately $305,000, or 76% of the revised loss estimate, after signing a permit that authorized withdrawals of interest-bearing aWETH tokens.
The investigation also identified a consistent revenue-sharing arrangement in the malicious token-draining infrastructure. Each identified token drain sent 80% of the stolen assets to the attacker and 20% to a wallet associated with the drainer-kit operator.
The additional 26.38 ETH followed another route. A collector retained 5%, forwarded the remainder to an intermediary, and approximately 20.95 ETH subsequently reached the attacker’s wallet.
That ether was there already, the first estimate simply missed it.
The revised figure does not represent a newly discovered tenth victim. Bitquery attributed the additional loss to one of the nine wallets already included in its investigation.
The firm also challenged an earlier $294,000 loss estimate, explaining that the amount matched the balance of the drainer-kit fee wallet, much of which predated the Across incident.
The attack exploited wallet-signing permissions rather than a vulnerability in Across’s bridge contracts. DaveFinances previously examined how malicious permits and wallet approvals can authorize cryptocurrency theft, including situations where connecting to a legitimate-looking website precedes a damaging signature.
Across attacker routes funds through Hyperliquid, Solana and Bitcoin
Bitquery’s tracing identified three principal routes through which the attacker moved cryptocurrency after collecting proceeds from the compromised website.
Approximately $100,000 was moved through Arbitrum and converted into XMR1 on Hyperliquid. The two receiving wallets held XMR1 worth approximately $101,000 in the investigation’s November 11 snapshot.
XMR1 is a token designed to track Monero’s value. Its presence on Hyperliquid does not establish that the attacker obtained native Monero or completed a privacy-shielded withdrawal.
Another approximately $100,000 moved through Chainflip into Solana before reaching an address Bitquery associated with online casino Rainbet. The attribution relies on wallet labels and transaction behavior rather than an independently confirmed customer-account record.
The casino attribution, it is a lead rather than a confirmed identity.
A third route converted approximately $96,000 into Bitcoin through THORChain, producing 1.305 BTC at a newly created address. The Bitcoin remained unspent when investigators last examined it.
Bitquery estimated that approximately $35,000 remained on Ethereum. Its reconstruction also cautioned that the intermediary handling the additional ether had received funds from other activity, meaning not every dollar subsequently routed through the attacker-linked splitting wallet could be attributed exclusively to Across victims.
Across has promised to reimburse affected users and publish a full post-mortem. The commitment has not yet been accompanied by a publicly verified total of completed repayments.
Rujira confirms $200,000 exploit in BTC/USDC liquidity strategy
Rujira disclosed on November 11 that an attacker had exploited a vulnerability in the skew calculations of its Custom Concentrated Liquidity (CCL) strategy on THORChain, resulting in estimated losses of approximately $200,000.
The attack occurred on the evening of November 10, when unusual activity on Rujira Trade triggered a sharp price spike in the BTC/USDC market, followed by increased trading across the orderbook.
According to Rujira’s technical disclosure, the attacker manipulated trading activity to exploit the strategy’s skew-calculation mechanism, leaving existing concentrated-liquidity positions imbalanced.
The protocol attributed approximately $175,000 of the estimated loss to Liquidy Finance’s CCL positions, with another $25,000 involving other users’ funds.
For Rujira the amount is smaller, the application pause was not a small one.
Rujira halted the CosmWasm application layer while preparing to remove the vulnerable skew parameter from its contracts. The team said it intended to reimburse all affected users before requesting that THORChain node operators resume application-layer activity.
Its initial estimate allowed one to two days for recovery work, although that timetable was not a confirmation that all reimbursements or repairs had been completed.
The incident concerns Rujira’s application-level trading strategy. The disclosed evidence does not establish a compromise of THORChain’s underlying native-asset swap infrastructure.
The vulnerability also differs from the BitBay StableVault exploit involving zero-liquidity withdrawal logic, which DaveFinances covered in October. Both involved exploitable assumptions in liquidity-management software, but Rujira’s disclosed failure concerns skew calculations during trading, rather than withdrawals from an empty liquidity position.
Rujira has not disclosed the attacker’s transaction-level profit, identified the exploiter or published a final accounting of completed compensation. Its estimated $200,000 loss remains based on the team’s preliminary assessment.
Arcus attacker moved $2.23 million before wallet restrictions took effect
A November 11 investigation by blockchain intelligence service PublicAML has reconstructed how an attacker moved approximately $2.23 million from Arcus, a decentralized perpetual trading protocol operating on Robinhood Chain, before the exchange blocked the exploiter’s addresses.
The underlying exploit occurred on November 10 UTC, after an attacker manipulated transfers between Arcus subaccounts to inflate an account’s recorded balance and submit unauthorized withdrawals.
Arcus reported that the attacker successfully withdrew 2,234,391 USDG. An additional approximately $3 million in attempted withdrawals was blocked by the bridge’s rate limit and subsequently reversed. That prevented amount is not part of the realized loss.
PublicAML traced seven successful cross-chain transfers involving approximately 2,234,418 USDG through Relay.link, which delivered roughly 1,052.2 ETH on Ethereum.
The final transfer completed at 03:59 UTC on November 10. Arcus did not block the exploiter’s addresses until 04:43 UTC, approximately 44 minutes later.
The block came afterward, the assets had crossed the chain already.
The cross-chain transfer changed the options available for recovery. USDG is an issuer-controlled stablecoin whose balances can potentially be frozen, whereas native ETH cannot be frozen by a token issuer.
PublicAML subsequently identified approximately 475.90 ETH converted into 1,008,945 DAI through CoW Protocol. The DAI was transferred to a fresh Ethereum wallet, while approximately 101 ETH was converted through THORChain and Relay.link into 2.831 BTC.
As of the investigator’s November 11 snapshot, approximately 475.06 ETH remained at the original Ethereum address, alongside the DAI and Bitcoin holdings at other attacker-linked addresses. PublicAML reported no identified transfers of those assets to centralized exchanges or mixers at that point.
The exploit involved an internal accounting weakness rather than the same withdrawal-verification vulnerability described in DaveFinances’ earlier report on the zkLink Nova bridge exploit involving forged withdrawal roots. In the Arcus case, inaccurate subaccount balances enabled the unauthorized withdrawals before the funds were converted and routed away.
Arcus said it patched the vulnerability, restored withdrawals and covered the entire $2.23 million shortfall from its company treasury. The company reported that other customer balances, positions and orders were unaffected.
That treasury payment represents compensation for the protocol’s accounting shortfall, not recovery of the cryptocurrency still controlled by the attacker.
A separate on-chain message purporting to come from the Arcus team offered the exploiter a 10% bounty, approximately $223,000, for returning the remaining 90% by November 13 at 01:00 UTC. The message’s authorship has not been independently confirmed through Arcus’s published incident report, and a completed return has not been established.
The three incidents leave different recovery positions. Across has promised repayment following a domain compromise, Rujira has committed to removing vulnerable trading logic and compensating affected liquidity providers, while Arcus has already funded its shortfall internally despite the stolen assets remaining outside its control.
Across’s revised forensic estimate, Rujira’s preliminary loss calculation and Arcus’s treasury-funded compensation describe different stages of the incidents. None should be mistaken for a confirmed total of stolen assets returned through blockchain recovery.
Johan Shamshad is Editor-in-Chief at Dave Finances, covering financial markets, digital assets, trading platforms, brokers, fintech, payments and regulation. Since 2023, he has also worked as an editor at Gulf News, the UAE English-language newspaper published by Al Nisr Publishing LLC. His work focuses on market-moving developments, company disclosures, regulatory changes and trading infrastructure, with an emphasis on primary-source verification and practical context for traders and investors.