Ethereum

2024

Metamask

ERC20

<a href="https://bitcoinworld.co.in/dydx-exchange-releases-postmortem-on-31k-squarespace-account-hack-lost/" title="dYdX Exchange Releases Postmortem on $31K Squarespace Account Hack Lost" rel="noopener noreferrer nofollow"></a>
<ul>
 <li style="font-weight: 400">dYdX has released a detailed postmortem on the Squarespace account hack, outlining the events and their responses.</li>
</ul>
dYdX, a prominent crypto exchange, <a href="https://twitter.com/dYdX/status/1816547431791886756" rel="noopener noreferrer nofollow">announced</a> on July 23 that its version 3.0 website had been compromised.
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 The domain registrar for <a href="https://t.co/Ym1dFLMmm5" rel="noopener noreferrer nofollow">https://t.co/Ym1dFLMmm5</a> (previously Squarespace) has confirmed that on July 23rd, dYdX Trading’s Squarespace account was accessed by unauthorized individuals after they successfully social-engineered Squarespace customer support.
 — dYdX (@dYdX) <a href="https://twitter.com/dYdX/status/1816547431791886756?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">July 25, 2024</a>
</blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
Users have been advised to avoid visiting the version 3.0 site or clicking any links until further notice. However, the team assured users that version 4.0 remains unaffected and is functioning normally.
dYdX has released a detailed postmortem on the Squarespace account hack, outlining the events and their responses. The exchange has decided to change domain registrars and continues to work with SEAL and other partners to prevent future incidents.
<h3 id="span-style-font-weight-400-dydx-exchange-website-compromised-due-to-social-engineering-attack-span">dYdX Exchange Website Compromised Due to Social Engineering Attack</h3>
According to the postmortem, the breach occurred after unauthorized individuals accessed dYdX Trading’s Squarespace account through a social engineering attack on Squarespace customer support.
During the two-hour hijacking of the exchange domain, two users lost funds totaling approximately $31,000. dYdX Trading is in contact with the affected users to ensure they are compensated.
In 2023, Squarespace acquired all domains from the now-defunct Google Domains, migrating them over several months. The dydx.exchange domain, owned by dYdX Trading, was moved to Squarespace on June 15, 2024.
On July 9, attackers gained access to the dydx.exchange domain and modified the DNS nameservers from Cloudflare to DDoS-Guard.
This initial attack was mitigated by DNSSEC settings, which prevented users from accessing the compromised site. DYdX quickly resolved the issue through password and two-factor authentication (2FA) rotations.
Following reports of similar attacks on crypto-specific domains, SEAL, a crypto-focused security team, initiated an investigation. It was discovered that an OAuth vulnerability on Squarespace had been exploited, which Squarespace addressed and fixed on July 12.
Despite this, the dydx.exchange domain was compromised again on July 23. Attackers managed to change the DNS Nameservers and remove DNSSEC settings, hosting a malicious site that tricked users into transferring Ethereum and ERC20 tokens.
During this period, dYdX collaborated with SEAL and other partners to block malicious sites on popular crypto wallets like Metamask and Phantom. Despite these efforts, two users lost $31,000 during the attack.
<h3 id="span-style-font-weight-400-dydx-exchange-recovers-website-following-squarespace-account-hack-span">dYdX Exchange Recovers Website Following Squarespace Account Hack</h3>
The postmortem <a href="https://twitter.com/dYdX/status/1816547435243798531" rel="noopener noreferrer nofollow">further</a> revealed that the attacker had set the domain admin email to an address ending in outlook.com, with a username similar to the legal name of the billing administrator on dYdX’s account.&nbsp;
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 After re-securing the domain, additional controls have been added to ensure this never happens again, including migrating the domain to Cloudflare.
 — dYdX (@dYdX) <a href="https://twitter.com/dYdX/status/1816547435243798531?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">July 25, 2024</a>
</blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
This suggested a social engineering attack, as the attacker used a believable email address.
According to dYdX, its communications with Squarespace revealed that a human error initiated the takeover during the account-recovery process.
The attacker bypassed 2FA and modified the account email without providing valid security credentials. Squarespace’s customer service did not attempt to contact any other listed admins on the domain before making these changes.
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 <a href="https://t.co/Ym1dFLLOwx" rel="noopener noreferrer nofollow">https://t.co/Ym1dFLLOwx</a> website has been recovered by dYdX Trading Inc. <img src="https://s.w.org/images/core/emoji/15.0.3/72x72/1f64f.png" alt="🙏" class="wp-smiley" style="height: 1em; max-height: 1em;">
 Please note that your machine may still be caching the compromised site.
 Make sure to clear your cache and restart your browser before connecting to the website.
 — dYdX (@dYdX) <a href="https://twitter.com/dYdX/status/1815835205334073537?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">July 23, 2024</a>
</blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
In response to the attack, dYdX transferred its domain registration to Cloudflare to enhance security. The transfer was expedited and completed within six hours.
dYdX confirmed that there were no security issues with its smart contracts, backend systems, or the dYdX Chain as a result of the incidents.
The dYdX team stated social media X, advising users to clear their browser cache and restart their browser before reconnecting to the website to ensure they were not accessing the compromised site.

dYdX Exchange Releases Postmortem on $31K Squarespace Account Hack Lost

Table of Contents

ItsBitcoinWorld

Další články publikované 27. 7. 2024

Weekly Article Recap: 7/15-7/19

Edward Snowden on Bitcoin: We Are Winning

Hive Announces Plans to Move Into Paraguay Amidst Bitcoin Mining Power Hike Turmoil

XRP Primed for Massive Breakout Despite Recent Drop: Analyst Predict $20 Surge

Trump’s Keynote at Bitcoin 2024: What to Expect

Bitcoin 2024 day 2 recap: Saylor’s vision, RFK’s remarks steal the show in Nashville

Join our free newsletter for daily crypto updates!