Ethereum

Swap

RaveDAO

Ethereum Name Service

Domain

Ethereum Name Service gateway eth.limo has revealed that the domain hijacking on Friday was caused by a social engineering attack directed against EasyDNS, its domain name service provider.&nbsp;
According to a postmortem <a href="https://x.com/eth_limo/status/2045552916157563148" rel="noopener noreferrer nofollow">published</a> by eth.limo on Saturday, an attacker impersonated one of its team members to initiate an account recovery process with easyDNS, granting access to the eth.limo account and allowing them to alter domain settings.
“The NS records were changed and directed to Cloudflare… Once we understood that a DNS hijack had taken place, we immediately notified the community as well as Vitalik Buterin and others. We then began contacting EasyDNS in an attempt to respond to the incident,” the company said.
Eth.limo serves as a Web2 bridge, providing access to around 2 million decentralized websites using the .eth domain name. Hijacking the service could allow an attacker to redirect users to malicious websites. <a href="https://cointelegraph.com/explained/vitalik-s-take-on-decentralized-stablecoins-what-it-means-for-defi" rel="noopener noreferrer nofollow">Ethereum co-founder Vitalik</a> Buterin <a href="https://x.com/VitalikButerin/status/2045413438659416215" rel="noopener noreferrer nofollow">warned</a> users Friday to avoid his blog until the incident was resolved.
Mark Jeftovic, CEO of easyDNS, has publicly <a href="https://easydns.com/blog/2026/04/18/we-screwed-up-and-we-own-it-the-eth-limo-shtshow-is-on-us/" rel="noopener noreferrer nofollow">accepted</a> responsibility for the incident in its own postmortem report.&nbsp;
“We screwed up and we own it,” said Jeftovic on Saturday.&nbsp;
<blockquote>
 “This would mark the first successful social engineering attack against an easyDNS client in our 28-year history. There have been countless attempts.”&nbsp;&nbsp;
</blockquote>
Both companies have pointed to the Domain Name System Security Extension (DNSSEC) in thwarting the hacker’s attempts to do further damage.&nbsp;
The attacker couldn’t produce valid cryptographic signatures, so Domain Name System resolvers rejected the attacker’s forged DNS responses, causing users to see error messages instead of being redirected to malicious sites.&nbsp;
“DNSSEC was enabled for their domain when the attackers attempted to flip their nameservers, presumably to effect some manner of phishing or malware injection attack, DNSSEC-aware resolvers, which most are these days, began dropping queries,” Jeftovic said.&nbsp;
<figure><img src="https://s3.cointelegraph.com/uploads/2026-04/019da932-56ad-716e-823b-dc2c63c2eb9a.png" alt="Hackers impersonated eth.limo team to hijack its domain: Post-mortem">
 <figcaption>Source: <a href="https://x.com/eth_limo/status/2045552916157563148?s=46&amp;t=MuRujqZUAz3TQE1vmr3c6A" rel="noopener noreferrer nofollow">eth.limo</a>
 </figcaption>
</figure>
In its postmortem, eth.limo noted that because the attacker lacked the signing keys, they were unable to bypass the safeguards, which likely “reduced the blast radius of the hijack. We are not aware of any user impact at this time. We will provide updates if that changes.”
<h2 id="easydns-makes-changes-since-the-attack">easyDNS makes changes since the attack</h2>
Jeftovic described the <a href="https://cointelegraph.com/explained/how-scammers-target-crypto-users-during-the-holidays-and-how-to-stay-protected" rel="noopener noreferrer nofollow">social engineering attack</a> as “highly sophisticated,” and said easyDNS is still conducting a post-mortem on how the breach occurred, and has already begun rolling out changes to prevent a recurrence. 
<figure><img src="https://s3.cointelegraph.com/uploads/2026-04/019da932-5b8f-7262-ad47-9a91bca053ba.png" alt="Hackers impersonated eth.limo team to hijack its domain: Post-mortem">
 <figcaption>Source: <a href="https://x.com/easydns/status/2045547328870756595?s=46&amp;t=MuRujqZUAz3TQE1vmr3c6A" rel="noopener noreferrer nofollow">easyDNS</a>
 </figcaption>
</figure>
“In eth.limo’s case, we will be migrating them to Domainsure, which has a security posture more suited toward enterprise and high-value fintech domains, TLDR there is no mechanism for an account recovery on Domainsure, it’s not a thing,” he added.
“On behalf of everyone here, I apologize to the eth.limo team and the wider Ethereum community. ENS has always had a special place in our heart as the first registrar to enable ENS linking to web2 domains and we’ve been involved in the space since 2017.”
Related: <a href="https://cointelegraph.com/news/ravedao-denies-manipulation-binance-bitget-probe-rave-trading" rel="noopener noreferrer nofollow">RaveDAO denies manipulation as Binance, Bitget probe RAVE trading activity</a>
The eth.limo incident is the latest in a series of domain hijackings targeting crypto projects. Days earlier, decentralized exchange aggregator CoW Swap <a href="https://cointelegraph.com/news/cow-swap-dao-domain-hijacking" rel="noopener noreferrer nofollow">lost control of its website after an unknown</a> party hijacked its domain.&nbsp;
Steakhouse Financial, a DeFi advisory and research firm, similarly <a href="https://x.com/SteakhouseFi/status/2042649690420724030?s=20" rel="noopener noreferrer nofollow">disclosed</a> at the end of March that it had lost control of its domain to an attacker.
Magazine: <a href="https://cointelegraph-magazine.com/clarity-act-define-path-non-custodial-defi-us/" rel="noopener noreferrer nofollow">Will the CLARITY Act be good — or bad — for DeFi?</a>

Hackers impersonated eth.limo team to hijack its domain: Post-mortem

Table of Contents

Cointelegraph

Other articles published on Apr 20, 2026

Join our free newsletter for daily crypto updates!