Aave user loses $305,000 after Across Protocol website hijack

A depositor in Aave lost about $305,000 in a deposit token during the Nov. 10 hijack of the cross-chain bridge Across Protocol's website, according to a Bitquery investigation updated Nov. 12.

Bitquery links the loss to spending permissions requested through the compromised interface, exposing a lending position held outside the bridge.

Bitquery's revised trace estimates $401,900 taken from nine wallets across five blockchains, using prices at the time the assets were stolen, and the Aave depositor accounts for about 76% of the traced losses. The update adds a previously missed ether sweep.

Across Protocol said its domain was taken over on Nov. 10 through social engineering involving its registrar, Namecheap.

How the Aave deposit token moved after the Across Protocol hack

The asset taken from the largest wallet was aWETH, an interest-bearing token representing an Aave deposit. Aave's documentation explains that its deposit tokens can be transferred and that a signed permit can authorize another account to spend them.

In Bitquery's reconstruction, the fake site requested a permit, which the attacker then used to move the depositor's tokens, and that spending permission put the separate lending position within reach.

The first transfer transaction on Nov. 10 recorded an unlimited approval followed by about 115.23 aWETH sent to one wallet and 28.81 aWETH to another. Bitquery identifies those recipients as the attacker's wallet and the drainer's fee wallet, respectively, matching an 80/20 split.

The depositor's transfer history shows four pulls ending three minutes after the first. Bitquery says the owner revoked the approval a minute after the last pull, but the transfers had already happened by that point.

How the website attack reached an Aave deposit

Bitquery links a signed permit to the loss of an Aave deposit token. The first transaction records spending approval followed by two transfers.
ONE AAVE DEPOSITOR $304,500 76% of Bitquery's traced losses Valued when the assets were taken Aave deposit token: 148.60 aWETH $401,900 traced across nine wallets · November 12 update
ONE AAVE DEPOSITOR $304,500 76% of Bitquery's traced losses 148.60 aWETH · theft-time value $401,900 across nine traced wallets

Inside the first Aave-token transaction

Inside the first Aave-token transactionSpending permissionToken transfers
Bitquery describes a signed permit. The transaction records unlimited approval before the token transfers.
WEBSITE ROUTE: BITQUERY'S RECONSTRUCTION Across website Compromised interface Signed permit Spending permission Aave deposit token aWETH in the user's wallet Unlimited aToken approval recorded 20:09:23 UTC · November 10, 2026
WEBSITE ROUTE: BITQUERY'S ACCOUNT Across website Compromised interface Signed permit Permission to spend the deposit token aWETH in the user's wallet Unlimited approval recorded 20:09:23 UTC · November 10, 2026
The same transaction sent about 115.23 aWETH and 28.81 aWETH to the wallets Bitquery identifies as attacker and fee recipients.
FIRST OF FOUR PULLS · 20:09:23 UTC · NOVEMBER 10, 2026 Aave deposit token From depositor's wallet 80% 20% 115.23 aWETH Attacker's wallet* 28.81 aWETH Drainer fee wallet* Recipient roles attributed by Bitquery
FIRST OF FOUR PULLS · NOV. 10, 2026 20:09:23 UTC Aave deposit token From depositor's wallet 80% 20% 115.23 aWETH Attacker wallet 28.81 aWETH Fee wallet* *Recipient roles attributed by Bitquery

Spending permission over a transferable deposit token can expose a lending position held outside the bridge.

Bitquery infers the website connection from timing and recipient wallets. Blockchain records do not show the visited site or off-chain signing time. The split diagram covers only the first pull; $304,500 is the whole traced Aave-token loss.
Sources and evidence

Sources

1. Bitquery November 12 investigation
2. Aave tokenization documentation
3. First Aave-token transaction
4. Depositor token transfer history

Supporting facts

• Bitquery's November 12 investigation update estimates $401,900 taken from nine wallets on Ethereum, Arbitrum, Base, BNB Chain and Optimism during the November 10 Across website hijack. [1]
• Bitquery identifies the largest affected wallet as an Aave depositor that lost 148.60 aWETH, which it values at about $304,500, or 76% of its traced losses. [1] [4]
• Aave's aTokens represent supplied assets and accrued yield, can be transferred or traded, and support permit messages that authorize another account to spend them. [2]
• At 20:09:23 UTC on November 10, an Ethereum transaction recorded an unlimited aToken approval from wallet 0x42e7...483c and transfers of about 115.23 aWETH to 0x2846...1fde and 28.81 aWETH to 0x0c7c...d37b. [3] [1]
• The Aave depositor's transfer history shows four outgoing aToken pulls between 20:09:23 and 20:12:23 UTC on November 10; Bitquery says the owner revoked the approval a minute after the last pull. [4] [1]
• The Aave transaction records show approval-based transfers of the depositor's aToken, consistent with Bitquery's account of a signed-permit theft. [1] [2] [3]
• Bitquery links the drains to across.to through their timing and recipient wallets, while acknowledging that on-chain records do not identify which website a victim visited. [1]

Method

Uses reported rounded figures and the reported 76% share; the bar is 76% filled. Approval and transfer views show two parts of the same first transaction, not separate website observations. The total Aave loss spans four pulls.

Scope

Bitquery infers the website connection from timing and recipient wallets. Blockchain records do not show the visited site or off-chain signing time. The split diagram covers only the first pull; $304,500 is the whole traced Aave-token loss.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.