Domain Hijacks Reveal Crypto’s Persistent Front-End Security Crisis

Across Protocol suffered a hijacking of its official domain, with attackers redirecting users to a phishing website designed to steal cryptocurrencies. Meanwhile, Initia confirmed its second attack in less than three weeks, this time involving compromised cloud systems, with affected assets totaling approximately $3.27 million.

Both incidents expose a problem the crypto industry has yet to solve: a blockchain can function correctly while the infrastructure used to access it allows users to lose their funds.

Smart contract audits, cryptographic verification, and consensus mechanisms do not automatically protect the domains, servers, and credentials managed by development teams.

Protocol security must cover everything that happens before a user signs a transaction. Otherwise, even a technically sound application can become an entry point for attackers.

Even a Legitimate Domain Can Be Dangerous

Across representatives explained that a social engineering attack targeting its domain registrar, Namecheap, allowed third parties to take control of the domain and replace the website with a fraudulent page.

Visitors could encounter authorization requests that allowed attackers to withdraw assets from their wallets. A Bitquery investigation identified approximately $348,000 stolen from nine wallets.

Across regained control of the domain and announced that it would compensate affected users. It also recommended reviewing and revoking suspicious authorizations.

The incident is particularly concerning because users could enter the correct address and still end up on a website controlled by criminals.

Checking the URL, a common recommendation for avoiding phishing, is no longer sufficient when attackers control the domain itself.

The crypto industry needs to demand stricter safeguards from domain registrars for domain modifications, phishing-resistant authentication, and emergency procedures that allow compromised interfaces to be blocked quickly.

These measures will not prevent every attack, but they will reduce the need for individual users to detect manipulation before connecting their wallets.

The Risks of Credentials and Centralized Infrastructure

The attack against Initia had a different origin. According to information released by the project, the attackers exploited a compromised Google Cloud Platform key to access internal resources and obtain additional credentials.

They subsequently used infrastructure associated with Anvil to validate fraudulent withdrawals from five rollups.

The incident involved crypto assets worth $3.27 million, although approximately $2.16 million remains frozen on the network following its suspension.

The previous attack, which occurred in October, had exploited a different vulnerability related to contract execution in MoveVM.

For that reason, the two incidents should not be described as failures of the same interface. What they share is a dependence on operational components whose security is essential to protecting funds.

An exposed key can compromise systems that manage transactions, even when the main contracts do not contain the vulnerability exploited by the attacker.

Crypto Security Needs Stronger Safeguards

The industry often presents self-custody as a way to eliminate intermediaries. However, many users depend on websites, infrastructure providers, and wallet services to conduct transactions.

That dependence requires concrete responsibilities.

Protocols should publish infrastructure audits, enforce strict credential controls, and establish limits for extraordinary transactions. Wallets can also improve their warnings when an authorization grants access to cryptocurrencies.

Insurance or compensation funds can reduce the financial consequences, although they require transparent terms and sufficient reserves to respond to serious incidents.

Mechanisms can also be developed to limit unusual withdrawals or allow certain operations to be halted. These protections require caution: introducing emergency controls can also expand administrators’ power over crypto funds.

Across promised compensation, while Initia is working to recover the affected assets. But user protection should not depend solely on whether each project has enough money available after an attack.

If crypto applications aim to attract funds from millions of people, protecting smart contracts will remain insufficient as long as their domains, credentials, and interfaces continue to provide opportunities for theft.