Ethereum

Compound

DeFi

Multiple decentralized finance (DeFi) apps were targeted in a domain registry attack on July 11, according to an X post from blockchain security platform Blockaid. The attacker has taken control of the DNS registry for Compound Finance and has attempted — but failed — to take control of Celer Network’s registry.&nbsp;
After a preliminary investigation, Blockaid concluded that the attacker is targeting domain names provided by Squarespace, potentially putting any DeFi app with a Squarespace domain at risk.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-07/1bf65fba-c0fe-4923-be50-eadd6f8493f1.png" alt="DeFi apps targeted in apparent Squarespace DNS registry attack: Blockaid" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/blockaid_/status/1811423277161832698" target="_blank" rel="noopener nofollow">Blockaid</a>
 </figcaption>
</figure>
Security researchers first became aware of the attack when the Compound interface at compound.finance began redirecting to a malicious website. The malicious site was equipped with a drainer app that attempted to steal users’ tokens.
Related: <a href="https://cointelegraph.com/news/compound-finance-website-hijacked-security-warning">Compound Finance site potentially breached — ZachXBT</a>
At 1:38 pm UTC,&nbsp;Celer network announced that it, too, had been attacked. However, in this case, Celer stated that its domain monitoring system had detected the takeover and intercepted it before it could succeed.
At 3:38 pm UTC, Blockaid announced that “multiple DeFi front ends are at risk of hijacking, with a few incidents already taking place[.]” “From initial assessment, it appears that the attackers are operating by hijacking DNS records of projects hosted on SquareSpace,” it stated.
0xngmi, a developer at the blockchain analytics platform DefiLlama,&nbsp;<a href="https://gist.github.com/0xngmi/789e297f3107d3c28c56da7acf11828d" target="_blank" rel="noopener nofollow">posted</a> a list of domains that may be affected by the attack. The list includes more than 100 DeFi protocols, including Pendle Finance, dYdX, Polymarket, Satoshi Protocol, Nirvana, LooksRare and many others.
Web3 wallet MetaMask announced that it is attempting to warn users of possibly compromised apps associated with the attack. “For those of you using MetaMask, you’ll see a warning provided by @blockaid_ if you attempt to transact on any known site that’s involved in this current attack,” it stated.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-07/73e6da75-dc01-43ad-b941-b793da1ee7cd.png" alt="DeFi apps targeted in apparent Squarespace DNS registry attack: Blockaid" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/MetaMask/status/1811436757759701391" target="_blank" rel="noopener nofollow">MetaMask</a>
 </figcaption>
</figure>
Domain name hijacking has been one of several attacks against the Web3 industry over the past year. In December, an attacker <a href="https://cointelegraph.com/news/how-the-ledger-connect-hacker-tricked-users-into-making-malicious-approvals">injected malicious code</a> into the Ledger Connect library that most Web3 apps use for wallet connections, affecting nearly the entire Ethereum Virtual Machine ecosystem.
Magazine:&nbsp;<a href="https://cointelegraph.com/magazine/crypto-phishing-scammer-hedera/">Crypto-Sec: Phishing scammer goes after Hedera users, address poisoner gets $70K</a>

DeFi apps targeted in apparent Squarespace DNS registry attack: Blockaid

Cointelegraph

发布于 2024年7月11日的其他文章

Microsoft and Apple Step Back from OpenAI Board Amid Regulatory Scrutiny

Balancing Trader and Liquidity Provider Needs: Jupiter Exchange’s Fee Adjustment Strategy

Binance and Santos FC Launch Token

Bitrue Research: AO - The Nascent AI Blockchain

Bitcoin Option Traders Expect Near-Term Volatility, Crypto-Asset Trading Experts Say

Bahamians didn't want CBDCs — Now they're being forced to use them

订阅我们免费的电子期刊，获取每日最新加密领域动态！