The migration of Google\u2019s domain registrar to Squarespace resulted in more than 120 DeFi domains becoming vulnerable to DNS attacks.<\/p>\n
The web2 infrastructure underpinning web3 front-end interfaces continues to pose risks to users.<\/p>\n
Experts are urging web3 users to avoid interacting with the front-end interfaces of DeFi protocols after domain migrations associated with Squarespace\u2019s acquisition of Google\u2019s domain business left many websites vulnerable to domain name server (DNS) attacks.<\/p>\n
On July 11, the front-end domains for Compound Finance<\/a>, Pendle Finance<\/a>, and Celer Network<\/a> were targeted after the migration resulted in the two-factor authentication (f2a) securing websites previously managed by Google was deactivated. Compound, Pendle, and Celer each tweeted that their domains have since been secured.<\/p>\n \u201cA DNS attack is going on right now affecting Squarespace domain registrar,\u201d tweeted<\/a> Bobby Ong, the co-founder of CoinGecko. \u201cBest thing to do is to not interact with crypto and rest for the next couple of days until everything is resolved.<\/p>\n 0xngmi of DeFi Llama shared<\/a> a list of more than 120 DeFi domains that could be vulnerable to the attack. \u201cThis is a list of all domains that share this registrar so they could be at risk of being hacked,\u201d they said<\/a>.<\/p>\n Front-end user interfaces (UIs) allow users to interact with DeFi protocols via a typical graphical UI hosted via a web domain. While DeFi projects\u2019 front-ends may be vulnerable, the incident has not impacted underlying web3 back-end protocols \u2014 which facilitate server-side operations, databases, and application logic.<\/p>\n In June 2023, Google sold<\/a> its domain business to Squarespace. However, the websites were not migrated from Google to Squarespace until two days ago on July 10.<\/p>\n It appears that domain owners were not aware that their 2fa would be disabled as part of the transition, exposing numerous domains to potential DNS attacks. Attackers were able to redirect the DNS records of popular DeFi front-end websites to malicious addresses hosting wallet drainers and phishing attacks.<\/p>\n \u201cFrom initial assessment, it appears that the attackers are operating by hijacking DNS records of projects hosted on SquareSpace,\u201d tweeted<\/a> Blockaid, a web3 security firm. \u201cThe attackers are using a drainer kit associated with the most recent iteration of the Inferno drainer group.\u201d<\/p>\n Inferno Drainer is designed to trick unsuspecting users into approving malicious transactions that transfer a victim\u2019s funds to the hacker’s wallet.<\/p>\n \u201cOur bot detected that a new malicious DNS record was added to redirect Pendle\u2019s dApp to a malicious site,\u201d Pendle tweeted.<\/p>\n According to CertiK, phishing attacks accounted<\/a> for nearly $498 million worth of losses to crypto exploits during the first half of 2024, equating to 72% of the $688 million lost to all forms of attacks combined.<\/p>\n Squarespace did not respond to The Defiant\u2019s request for comment at the time of publishing.<\/p>\nDomain migration<\/h2>\n