Browse

Reference

Directory

Company

Help & Legal

Follow

Subscribe

Quick Take

A depositor in Aave lost about $305,000 in a deposit token during the Nov. 10 hijack of the cross-chain bridge Across Protocol's website, according to a Bitquery investigation updated Nov. 12.

Bitquery links the loss to spending permissions requested through the compromised interface, exposing a lending position held outside the bridge.

Bitquery's revised trace estimates $401,900 taken from nine wallets across five blockchains, using prices at the time the assets were stolen, and the Aave depositor accounts for about 76% of the traced losses. The update adds a previously missed ether sweep.

Across Protocol said its domain was taken over on Nov. 10 through social engineering involving its registrar, Namecheap.

Crypto wallet security crisis deepens as NGRAVE users face $2.65 million phishing attack

How the Aave deposit token moved after the Across Protocol hack

The asset taken from the largest wallet was aWETH, an interest-bearing token representing an Aave deposit. Aave's documentation explains that its deposit tokens can be transferred and that a signed permit can authorize another account to spend them.

In Bitquery's reconstruction, the fake site requested a permit, which the attacker then used to move the depositor's tokens, and that spending permission put the separate lending position within reach.

The first transfer transaction on Nov. 10 recorded an unlimited approval followed by about 115.23 aWETH sent to one wallet and 28.81 aWETH to another. Bitquery identifies those recipients as the attacker's wallet and the drainer's fee wallet, respectively, matching an 80/20 split.

The depositor's transfer history shows four pulls ending three minutes after the first. Bitquery says the owner revoked the approval a minute after the last pull, but the transfers had already happened by that point.

How the website attack reached an Aave deposit

Bitquery links a signed permit to the loss of an Aave deposit token. The first transaction records spending approval followed by two transfers.

Inside the first Aave-token transaction

Bitquery describes a signed permit. The transaction records unlimited approval before the token transfers.

The same transaction sent about 115.23 aWETH and 28.81 aWETH to the wallets Bitquery identifies as attacker and fee recipients.

Spending permission over a transferable deposit token can expose a lending position held outside the bridge.

Bitquery infers the website connection from timing and recipient wallets. Blockchain records do not show the visited site or off-chain signing time. The split diagram covers only the first pull; $304,500 is the whole traced Aave-token loss.

Sources

Supporting facts

Method

Uses reported rounded figures and the reported 76% share; the bar is 76% filled. Approval and transfer views show two parts of the same first transaction, not separate website observations. The total Aave loss spans four pulls.

Scope

The Nov. 12 addition was a separate 26.38 ETH sweep from another victim, valued by Bitquery at about $54,000 at the time. Its Ethereum transaction records show ETH leaving on Nov. 10.

The revised tally also differs from the widely circulated $294,000 figure, as Bitquery says that number matched the fee wallet's holdings, including funds that predated the Across attack.

Bitquery ties the drains to Across through timing and recipient wallets, while acknowledging that blockchain records cannot show which website a victim visited.

On Nov. 11, Across Protocol said the domain was back under its control and pledged to make affected users whole and publish a postmortem.

Notion users put access keys in AI chats. A supplier breach exposed them

Cookie Consent

We use cookies to improve your experience on our site. By using our site, you consent to cookies.

Cookie Preferences

Manage your cookie preferences below:

Essential cookies enable basic functions and are necessary for the proper function of the website.

CloudFlare provides web performance and security solutions, enhancing site speed and protecting against threats.

Service URL: developers.cloudflare.com (opens in a new window)

Google Analytics is a powerful tool that tracks and analyzes website traffic for informed marketing decisions.

Service URL: policies.google.com (opens in a new window)

Statistics cookies collect information anonymously. This information helps us understand how visitors use our website.

Clarity is a web analytics service that tracks and reports website traffic.

Service URL: clarity.microsoft.com (opens in a new window)

You can find more information in our Privacy Policy and .

Loading image…

This image could not be loaded.

The Catalyst