A recovery plan depends on more than access to a wallet. The website used to approve transactions, the platform holding funds and the software validating Bitcoin can each introduce a different risk. These were separate developments reported by PA News on November 11, 2026, at 17:17 UTC+8.
Across: a compromised website
Across said a social-engineering attack on its registrar, Namecheap, gave an attacker control of its domain at about 02:45 UTC+8 on November 11. The team said it received an alert within 15 minutes and began shutting down the site. SEAL911 marked across.to as a phishing site, and Cloudflare later removed its DNS records, making the phishing site inaccessible.
Across said some people who visited the site before it was taken down may have been affected; it had not disclosed a loss amount. It said affected users would be compensated and advised users to revoke relevant approvals through revoke.cash. Its frontend and API were to remain closed until the domain was secure. Across said third-party integrations and API users were unaffected.
Arcus: balances were not the same as available funds
Arcus said it found and fixed an accounting flaw within an hour on November 10. According to its account, a newly created user exploited how transfers between subaccounts were recorded, producing a balance greater than the funds held and requesting withdrawals. About $2.234 million in USDG was withdrawn on-chain before withdrawals were stopped. A further $3 million request was blocked by a cross-chain bridge rate limit, was not paid and was later canceled.
Arcus said it covered the entire shortfall from its corporate treasury, leaving user balances unaffected, and that trading and withdrawals were operating normally. That is the platform’s account of the incident, not a claim that the withdrawn funds had been recovered.
Bitcoin Core: check the version, not just the device
Bitcoin Core disclosed two previously fixed vulnerabilities on November 10. A high-severity issue, CVE-2025-62861, could leave an affected node unable to produce a block until restart after a chain reorganization; it affected versions 28.0–28.2 and 29.0–29.1 and was fixed in 30.0. A medium-severity compact-block issue, CVE-2025-62859, could stall block processing under specified peer conditions; fixes were included in 29.2 and 30.0.
For readers who run Bitcoin Core, the source-supported check is the installed version and whether it includes the relevant fix. These disclosures concern node behavior, not a reported theft of wallet keys.