DeFi

Omni Network

Ether.fi, a decentralized finance (DeFi) staking protocol, has reported that no user funds were compromised during the recent domain takeover attack.
On Sept. 24, the DeFi protocol faced an attempted domain account takeover involving their domain registrar, Gandi.net, but was stopped before significant harm could occur.
The Ether.fi internal team confirmed that attackers could not present a malicious decentralized application (DApp) on any Ether.fi-related domain.
<figure><img alt="Ether.fi thwarts domain account takeover attempt, confirms user funds safe" name="" src="https://s3.cointelegraph.com/uploads/2024-09/019228c2-089d-70d5-84df-80f392266517">
 <figcaption style="text-align: center;">
 Source: <a data-ct-non-breakable="null" href="https://x.com/ether_fi/status/1838735907588820993" rel="noopener noreferrer nofollow" target="_blank" text="null" title="https://x.com/ether_fi/status/1838735907588820993">Ether.fi</a>
 </figcaption>
</figure>
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/ether-fi-crypto-native-credit-card-zk-rollup-scroll" rel="noopener noreferrer nofollow" target="null" text="null" title="null">Ether.fi launching ‘crypto-native’ credit card on ZK-rollup Scroll</a>
<h2 id="ether-fi-responds-to-attack">Ether.fi responds to attack</h2>
The breach began on Sept. 24 when the DeFi protocol received a recovery notification email from Gandi.net at 4:38 pm UTC.
After verification through the protocol’s security measures, including “SPF, DKIM, and DMARC authentication records,” it was discovered that the attacker was behind the email.
According to an official Ether.fi summary Gitbook <a data-ct-non-breakable="null" href="https://etherfi.gitbook.io/etherfi/security/sep-24-incident-attempted-domain-account-takeover" rel="noopener noreferrer nofollow" target="null" text="null" title="null">post</a>, “it was established an attacker attempted to use the legitimate Gandi recovery flow to gain access to etherfi’s Gandi account.”
Ether.fi immediately contacted Gandi across multiple platforms, and by 7:30 pm UTC, the DeFi staking protocol had confirmed that its account had been locked down to prevent further tampering.
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/restaking-inevitable-risks-still-uncertain-ether-fi-ceo" rel="noopener noreferrer nofollow" target="null" text="null" title="null">Restaking is ‘inevitable,’ but the risks are still uncertain — Ether.fi CEO</a>
<h2 id="security-measures">Security measures</h2>
The DeFi protocol implemented security upgrades before the attempted attack, which acted as a buffer to mitigate the threat of the domain takeover attempt.
According to the official Gitbook post weeks prior, Ether.fi noticed an increase in the exploitation of similar attack vectors across other platforms.&nbsp;
As a precaution, the protocol upgrades its key platforms to require hardware authentication for account recovery and management procedures.
Ether.fi credited its security partners, including Seal911, Doppel, Ethena, and Distrust, for immediate assistance during the attack.
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/omni-network-seals-600-million-deal-ether-fi" rel="noopener noreferrer nofollow" target="null" text="null" title="null">Omni Network seals $600M deal with Ether.Fi</a>
<h2 id="follow-up-communication-and-fund-safety">Follow-up communication and fund safety</h2>
On Sept. 24 at 07:13 pm UTC, Ether.fi communicated to its users via social media platform X that they should not “click on any links” or interact with their domain.
The DeFi protocol noted that official communications would come solely through X or Discord and explicitly stated that no communication would come through email.
After resolving the incident, the team stated that “all funds are safe” and that the attackers had “no opportunity” to issue any malicious DApps “on any ether.fi related domain.”
Magazine: <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/lady-of-crypto-bull-market-plans-2025-hall-of-flame/" rel="noopener noreferrer nofollow" target="null" text="null" title="null">Lady of Crypto will be ‘all out of crypto’ by September 2025: X Hall of Flame</a>

Ether.fi thwarts domain account takeover attempt, confirms user funds safe

Table of Contents

Cointelegraph

Other articles published on Sep 25, 2024

Data Revealed: Giant Whale and Shark Wallets Accumulate This Altcoin

Bitwise CIO: Ethereum ETFs came too early

Bitcoin’s Comeback: Could China’s Easing Spark a New Rally?

Congress Challenges SEC’s Authority on Digital Asset Security Regulation

Join the “Who is the Best WEMIX PLAYER?” Challenge

Investors Are Shifting from Ethereum to Solana: Analyst

Join our free newsletter for daily crypto updates!