Squarespace DNS Hack Exposes Hundreds of DeFi Projects to Drainer Attacks
The decentralized finance (DeFi) ecosystem was rocked today by a massive domain name system (DNS) hijacking incident that targeted multiple DeFi applications. The attack, traced back to a vulnerability in Squarespace’s domain registry, compromised numerous DeFi platforms, including Compound Finance and Pendle Finance.
⚠️ Developing situation - Multiple DeFi front ends are at risk of hijacking, with a few incidents already taking place, with projects like @compoundfinance and @CelerNetwork getting hacked over the past 24 hours.
— Blockaid (@blockaid_) July 11, 2024
We will update this thread with details as we go. pic.twitter.com/iWQR0ByIgB
Security researchers at Blockaid were the first to identify the attack when the Compound Finance website began redirecting users to a malicious site equipped with a drainer app designed to steal user funds.
Celer Network also fell victim to the attack but managed to prevent a successful takeover due to its robust domain monitoring system.
✅Thanks to our 24/7 domain security monitoring, an attempted takeover of Celer domains was successfully intercepted. All DNS records have been recovered. Our ongoing investigation indicates that the attack vector likely involved third parties beyond our control.
— CelerNetwork (@CelerNetwork) July 11, 2024
👁️The Celer…
The scale of the attack is staggering, with Blockaid estimating that hundreds of DeFi projects using Squarespace domains are at risk. A list compiled by DefiLlama developer 0xngmi includes over 100 potentially affected domains from platforms such as DyDx, Polymarket, LooksRare, Aptos, Near, Litecoin, and more.
Observers have warned that more names might be affected. Google sold its domain business to Squarespace several months ago and the forced migration of domains removed 2FA, causing all these domains to be vulnerable.
To protect users, MetaMask has implemented a warning system that alerts users attempting to interact with compromised sites. The wallet provider is actively working to identify and flag affected platforms.
As the investigation into the Squarespace DNS hack continues, DeFi users are advised to exercise extreme caution when interacting with any platform until the situation is fully resolved.