lighter-onchain[.]xyz

This domain poses as a legitimate interface for Across, a cross-chain bridging protocol, but is designed to deceive users into connecting wallets to malicious smart contracts. Analysis indicates the site functions as a crypto drainer, tricking victims into signing transactions that transfer assets to attacker-controlled addresses. The impersonation extends to visual design, page structure, and terminology, closely mimicking the authentic Across platform to exploit user trust in the brand. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious infrastructure. VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious, while AlienVault OTX lists it in one threat intelligence pulse. The site resolved to IP address 172.67.129.35 and was blocked by three major security providers, including MetaMask and SEAL. Additionally, it appeared on three independent security blocklists, further confirming its malicious classification. Users who visited www.lighter-onchain.xyz should immediately revoke any smart contract approvals granted through the site using a blockchain explorer or wallet interface. Check all connected wallet addresses for unauthorized transactions, particularly those involving token transfers or approvals. If assets were lost, document all transaction hashes and report the incident to relevant blockchain security teams and law enforcement. Monitor wallets for suspicious activity, as attackers may attempt follow-up attacks using stolen credentials or approvals. Consider migrating assets to a new wallet if multiple approvals were granted to unknown contracts.