A depositor in Aave lost about $305,000 in a deposit token during the Nov. 10 hijack of Across Protocol's website, according to a Bitquery investigation updated Nov. 12.
Bitquery estimates total losses of $401,900 across nine wallets on five blockchains, using prices at the time the assets were stolen. The Aave depositor accounts for about 76% of the traced losses. The update added a previously missed ether sweep.
How the Aave deposit token moved
The asset taken from the largest wallet was aWETH, an interest-bearing token representing an Aave deposit. Aave's documentation says its deposit tokens can be transferred and that a signed permit can authorize another account to spend them.
In Bitquery's reconstruction, the fake site requested a permit, which the attacker then used to move the depositor's tokens. The first transfer transaction recorded an unlimited approval followed by about 115.23 aWETH sent to one wallet and 28.81 aWETH to another. Bitquery identifies those recipients as the attacker's wallet and the drainer's fee wallet, matching an 80/20 split.
The depositor's transfer history shows four pulls ending three minutes after the first. Bitquery says the owner revoked the approval a minute after the last pull, but the transfers had already happened.
Trace scope and caveats
Bitquery infers the website connection from timing and recipient wallets. Blockchain records do not show the visited site or off-chain signing time. The split diagram covers only the first pull; $304,500 is the whole traced Aave-token loss.
The Nov. 12 addition was a separate 26.38 ETH sweep from another victim, valued by Bitquery at about $54,000 at the time. Its Ethereum transaction records show ETH leaving on Nov. 10.
The revised tally also differs from the widely circulated $294,000 figure. Bitquery says that number matched the fee wallet's holdings, including funds that predated the Across attack.
Across response
Across Protocol said its domain was taken over on Nov. 10 through social engineering involving its registrar, Namecheap. On Nov. 11, Across Protocol said the domain was back under its control and pledged to make affected users whole and publish a postmortem.
