Security researchers at blockchain security platform Blockaid have uncovered a targeted attack against several DeFi (Decentralized Finance) applications. The attack appears to exploit vulnerabilities within Squarespace’s domain name system (DNS) registry.
On July 11th, the first signs of trouble emerged when the user interface for Compound Finance, a popular DeFi platform, began redirecting users to a malicious website. This fake site was equipped with a program designed to steal users’ cryptocurrency tokens.
Blockaid’s investigation revealed the attackers had gained control of Compound Finance’s DNS registry. DNS essentially acts like an address book for the internet, translating domain names like “compound. finance” into the numerical IP addresses computers use to connect. By manipulating the DNS registry, attackers can redirect users to a fake website, mimicking the legitimate one.
⚠️ Developing situation – Multiple DeFi front ends are at risk of hijacking, with a few incidents already taking place, with projects like @compoundfinance and @CelerNetwork getting hacked over the past 24 hours.
We will update this thread with details as we go. pic.twitter.com/iWQR0ByIgB
— Blockaid (@blockaid_) July 11, 2024
Fortunately, the attack wasn’t entirely successful. While Compound Finance fell victim, Celer Network, another DeFi app, managed to thwart a similar attempt. Their domain monitoring system detected the attack in progress and successfully intervened before any damage could be done.
Blockaid’s analysis suggests the attackers are specifically targeting DeFi apps that use Squarespace for their domain name registration. This raises concerns for other DeFi platforms potentially using the same service.
