On November 11, cross-chain protocol Across announced that it had regained control of its domain and restored normal operations, and pledged to compensate affected users. The previous day's domain hijacking had directed some users to a fake website, with the risk then spreading to wallet permissions and lending assets. Meanwhile, demand for on-chain trading continued to cool: industry-wide spot trading volume on decentralized exchanges (DEXs) fell 18.63% in the seven days through November 11 compared with the preceding seven days.
Seven-day DEX volume falls 18.63%; Base TVL exceeds Solana's
DefiLlama's daily UTC statistics show that industry-wide DEX spot trading volume was approximately $7.698 billion on November 11, down 7.61% from the previous day. Cumulative volume for the seven days through that date was $56.377 billion, compared with $69.285 billion in the preceding seven days, a decline of 18.63%. Market-making and swap services still have a base of trading activity, but businesses that charge fees based on transaction value have seen their revenue opportunities shrink as demand for turnover has weakened.
Asset balances, however, diverged. Historical snapshots labeled November 11 show approximately $41.287 billion in total value locked (TVL) in protocols on Ethereum, down 1.41% from the previous day; $5.811 billion on Base, up 1.23%; $5.070 billion on Solana, up 0.33%; and $1.391 billion on Arbitrum, down 0.76%. Base's TVL had exceeded Solana's.
Over 30 days, TVL on Ethereum and Solana declined 15.32% and 18.28%, respectively, while Base fell 6.47% and Arbitrum edged up 0.60%. The four networks were not expanding in unison, with asset balances on some layer-2 networks proving relatively stable. Changes in TVL reflect both asset prices and protocol balances; assessing whether funds have migrated between networks also requires checking deposits and withdrawals of specific assets. Low transaction costs, access to applications and yield opportunities influence where assets remain, while a network token's price alone cannot summarize the operating performance of its applications.
Lending balances were also adjusting. Aave's daily historical snapshot for the same date showed TVL of approximately $16.161 billion, down 13.50% from 30 days earlier. Sustainable demand for deposits and borrowing underpins lending protocols, while cross-chain swaps give users a route to rebalance collateral, repay debt and seek yield. When spot turnover contracts and asset balances come under pressure, the availability and security of those routes affect how efficiently existing funds can be used.
Across regains domain control; approval phishing concentrates losses
Across disclosed that at approximately 18:45 UTC on November 10, attackers gained control of its domain through a social-engineering attack targeting domain registrar Namecheap. The team learned of the incident within about 15 minutes and then worked with security response organization SEAL 911, Cloudflare and others to flag the phishing risk and take down the domain's DNS records. At 01:16 on November 11, the team announced that the domain had been recovered and the system was operating normally.
The attack spread from the website entry point to wallet permissions. Even users entering a familiar address could be redirected to an attacker-controlled imitation site and induced to sign authorizations executable on-chain. Across said that API users and users of third-party integrations were unaffected; those affected were concentrated among people who visited the website before the malicious pages were fully blocked. Different ways of accessing the same protocol rely on different security boundaries.
An investigation published on November 11 by on-chain data company Bitquery found that, based on the transactions it identified, approximately nine wallets lost $348,000 across five chains. One Aave depositor lost approximately $305,000, accounting for about 88% of the total recorded in that investigation. According to the investigation, the user signed a permit authorization allowing token transfers, after which the attacker transferred away aWETH representing the user's deposit claim. Aave continued to account for positions under its protocol rules; the attacker exploited permission to transfer aWETH obtained through an external webpage.
Bitquery valued each theft transaction at prices prevailing when it occurred and excluded tokens for which prices could not be established. Across's recovery announcement pledged to make affected users whole, but it had not yet announced a final compensation amount or completion date. After the website's restoration, the remaining work included revoking malicious permissions, reconciling victim transactions and delivering compensation.
Competition in cross-chain infrastructure therefore extends beyond liquidity depth and quotes: domain registration, webpage deployment, wallet risk alerts and emergency shutdown mechanisms all affect whether users can complete operations safely. As industry trading volume declines, existing users and assets become more important. Reliable entry points, clearly defined permissions and actionable incident responses influence whether those funds can continue to participate in on-chain lending and trading.
Click “Read the original” for the full details.
