Ethereum

Cream Finance

Gemini

Ethereum Name Service

Ethereum<a href="https://yellow.com/asset/eth" rel="noopener noreferrer nofollow">(ETH)</a> co-founder Vitalik Buterin urged users on Apr. 18 to avoid all eth.limo addresses after the ENS gateway's domain registrar was breached.
<h2 id="eth-limo-gateway-breach">Eth.limo Gateway Breach</h2>
The attack hit eth.limo, a free open-source gateway that routes Ethereum Name Service content to standard web browsers. It converts ENS names into HTTPS links, letting users reach decentralized sites without running an IPFS node.
Attackers <a href="https://x.com/eth_limo/status/2045413512986411467" rel="noopener noreferrer nofollow">seized</a> control of the team's registrar account. That access let them redirect traffic across the wildcard *.eth.limo domain, opening the door to phishing pages or malware for anyone who visited.
Buterin <a href="https://x.com/VitalikButerin/status/2045413438659416215" rel="noopener noreferrer nofollow">posted</a> a direct IPFS link to his blog as a safe workaround. He also asked readers to wait for confirmation from the team before returning to any eth.limo page.
"The kind people at @eth_limo have warned me that there has been an attack on their DNS registrar. So please do not visit vitalik.eth.limo or other eth.limo pages until they confirm that things are back to normal," Buterin wrote.
The eth.limo team confirmed the hijack minutes later and said it was working with involved parties to restore control.
Also Read:<a href="https://yellow.com/news/mastercard-ripple-rlusd-card-settlement-gemini" rel="noopener noreferrer nofollow">Mastercard Pilots Ripple's RLUSD For Card Settlement With Gemini</a>
<h2 id="web3-registrar-risk">Web3 Registrar Risk</h2>
Security researchers <a href="https://beincrypto.com/eth-limo-dns-hijack-vitalik-warning/" rel="noopener noreferrer nofollow">say</a> the incident exposes a familiar weak point. ENS records and IPFS content stayed intact, but the DNS layer that links them to mainstream browsers still runs through centralized registrars.
Similar registrar-level breaches previously hit DeFi protocols Cream Finance and Aerodrome. Crypto phishing losses topped $4 billion in 2025, and frontend hijacks now rank among the most common attack methods.
No user fund losses have been confirmed. The team has yet to issue an all-clear.
Read Next:<a href="https://yellow.com/news/anchorage-digital-bitcoin-quantum-risk-zk-fix" rel="noopener noreferrer nofollow">Anchorage Digital Proposes Zero-Knowledge Fix For Bitcoin's Quantum Threat</a>

Ethereum Gateway Eth.limo Hijacked, Buterin Urges Users To Stay Away

Table of Contents

Yellow News

Other articles published on Apr 18, 2026

Join our free newsletter for daily crypto updates!