Understanding the Curve Finance DNS hijacking
On Could 12, 2025, at 20:55 UTC, hackers hijacked the “.fi” area identify system (DNS) of Curve Finance after managing to entry the registrar. They started sending its customers to a malicious web site, trying to empty their wallets. This was the second assault on Curve Finance’s infrastructure in every week.
Customers have been directed to an internet site that was a non-functional decoy, designed solely to trick customers into offering pockets signatures. The hack hadn’t breached the protocol’s good contracts and was restricted to the DNS layer.
The DNS is a essential element of the web that capabilities like a phonebook. It means that you can use easy, memorable domains (comparable to fb.com) as a substitute of advanced numerical IP addresses (like 192.168.1.1) for web sites. DNS converts these user-friendly domains into the IP addresses computer systems require to attach.
This isn’t the primary time Curve Finance, a decentralized finance (DeFi) protocol, has suffered such an assault. Again in August 2022, Curve Finance confronted an assault with comparable ways. The attackers had cloned the Curve Finance web site and interfered with its DNS settings to ship customers to a reproduction model of the web site. Customers who tried utilizing the platform ended up shedding their cash to the attackers. The undertaking was utilizing the identical registrar, “iwantmyname,” on the time of the earlier assault.
How attackers execute DNS hijacking in crypto
When a person sorts an internet deal with, their gadget queries a DNS server to retrieve the corresponding IP deal with and connect with the right web site. In DNS hijacking, fraudsters intrude with this course of by altering how DNS queries are resolved, rerouting customers to malicious websites with out their data.
Fraudsters execute DNS hijacking in a number of methods. Attackers would possibly exploit vulnerabilities in DNS servers, compromise routers, or acquire entry to area registrar accounts. The target is to vary the DNS data so {that a} person attempting to go to a authentic website is redirected to a faux, lookalike web page containing wallet-draining code.
Kinds of DNS hijacking embody:
- Native DNS hijack: Malware on a person’s gadget adjustments DNS settings, redirecting site visitors domestically.
- Router hijack: Attackers compromise dwelling or workplace routers to change DNS for all linked gadgets.
- Man-in-the-middle assault: Intercepts DNS queries between person and server, altering responses on the fly.
- Registrar-level hijack: Attackers acquire entry to a site registrar account and modify official DNS data, affecting all customers globally.
Do you know? In the course of the Curve Finance DNS assault in 2023, customers accessing the actual area unknowingly signed malicious transactions. The again finish was untouched, however tens of millions have been misplaced by a spoofed entrance finish.
How DNS hijacking labored within the case of Curve Finance
When attackers compromise an internet site with DNS hijacking, they’ll reroute site visitors to a malicious web site with out the person’s data.
There are a number of methods DNS hijacking can happen. Attackers would possibly infect a person’s gadget with malware that alters native DNS settings, or they might acquire management of a router and alter its DNS configuration. They might additionally goal DNS servers or area registrars themselves. In such instances, they modify the DNS data on the supply, affecting all customers attempting to entry the location.
Within the case of Curve Finance, the attackers infiltrated the programs of the area registrar “iwantmyname” and altered the DNS delegation of the “curve.fi” area to redirect site visitors to their very own DNS server.
A website registrar is an organization licensed to handle the reservation and registration of web domains. It permits people or organizations to say possession of a site and hyperlink it to internet providers like internet hosting and e mail.
The exact technique of the breach remains to be underneath investigation. By Could 22, 2025, no proof of unauthorized entry or compromised credentials was discovered.
Do you know? DNS hijacking assaults typically succeed by compromising area registrar accounts by phishing or poor safety. Many Web3 tasks nonetheless host domains with centralized suppliers like GoDaddy or Namecheap.
How Curve Finance responded to the hack
Whereas the registrar was gradual to reply, the Curve crew took measures to take care of the state of affairs. It efficiently redirected the “.fi” area to impartial nameservers, thus taking the web site offline whereas efforts to regain management continued.
To make sure secure entry to the frontend and safe fund administration, the Curve crew shortly launched a safe different at “curve.finance,” now serving because the official Curve Finance interface briefly.
Upon discovering the exploit at 21:20 UTC, the next actions have been taken:
- Customers have been instantly notified by official channels
- Requested the takedown of the compromised area
- Initiated mitigation and area restoration processes
- Collaborated with safety companions and the registrar to coordinate a response.
Compromise of the area however, the Curve protocol and its good contracts remained safe and absolutely operational. In the course of the disruption of the entrance finish, Curve processed over $400 million in onchain quantity. No person knowledge was in danger, as Curve’s entrance finish doesn’t retailer any person data.
All through the compromise, the Curve crew was at all times obtainable by its Discord server, the place customers may increase points with them.
After implementing instant injury management measures, the Curve crew is now taking extra steps to organize for the long run.
- Assessing and enhancing registrar-level safety, incorporating stronger protections and exploring different registrars
- Investigating decentralized front-end choices to get rid of dependence on vulnerable internet infrastructure
- Partnering with the broader DeFi and Ethereum Title Service (ENS) communities to advocate for native browser assist for “.eth” domains.
Do you know? Not like good contract exploits, DNS hijacks go away no hint onchain initially, making it laborious for customers to appreciate they’ve been tricked till funds are gone. It’s a stealthy type of crypto theft.
How crypto tasks can take care of DNS hijacking vulnerability
The Curve Finance assault is regarding as a result of it bypassed the decentralized safety mechanisms on the protocol degree. Curve’s backend, which means its good contracts and onchain logic, remained unhurt, but customers misplaced funds as a result of they have been deceived on the interface degree. This incident underscores a major vulnerability in DeFi.
Whereas the backend could also be decentralized and trustless, the entrance finish nonetheless is dependent upon centralized Web2 infrastructure like DNS, internet hosting and area registrars. Attackers can exploit these centralized choke factors to undermine belief and steal funds.
The Curve assault serves as a wake-up name for the crypto trade to discover decentralized internet infrastructure, comparable to InterPlanetary File System (IPFS) and Ethereum Title Service (ENS), to cut back reliance on weak centralized providers.
To handle the hole between decentralized backends and centralized frontends, crypto tasks should undertake a multi-layered method.
Listed here are varied methods crypto tasks can take care of this hole:
- Reduce reliance on conventional DNS: They will decrease reliance on conventional DNS by integrating decentralized options of DNS just like the ENS or Handshake, which cut back the chance of registrar-level hijacks.
- Use decentralized file storage programs: Internet hosting frontends on decentralized file storage programs comparable to IPFS or Arweave provides one other layer of safety.
- Implement area identify system safety extensions (DNSSEC): Groups ought to implement DNSSEC to confirm the integrity of DNS data and stop unauthorized adjustments.
- Safe registrar accounts: Registrar accounts should be secured with robust authentication strategies, together with multifactor authentication (MFA) and area locking.
- Prepare customers: Educating customers to confirm website authenticity, comparable to bookmarking URLs or checking ENS data, can cut back phishing success charges.
Bridging the belief hole between decentralized protocols and centralized interfaces is important for sustaining safety and person confidence in DeFi platforms.
