Curve Finance Faces Second DNS Hijack in a Week

According to Cointelegraph, decentralized finance protocol Curve Finance has issued a warning about a repeated hijacking of its domain name system (DNS), redirecting users to a malicious website. This marks the second attack on its infrastructure within a week. The Curve Finance team alerted users on May 12 via X, cautioning them against interacting with the compromised site. In response to inquiries about whether the incident was a hack or a hijack, the Curve team clarified that the website is pointing to an incorrect IP address. A DNS functions as a directory that converts domain names into IP addresses. Despite the security of passwords and the establishment of two-factor authentication long ago, the team has reached out to the registrar for assistance. While all smart contracts remain secure, the domain name currently directs users to a harmful site capable of draining wallets. Curve Finance is actively investigating the situation and working to regain access, with no evidence of compromise on their end. Curve Finance experienced a similar front-end attack in August 2022, where attackers cloned the website and redirected the DNS server to a fraudulent page. Users attempting to access the platform had their funds siphoned into a pool controlled by the attackers. Cointelegraph has reached out to Curve Finance for further comments. Onchain security firm Blockaid has also identified unusual activity from the Curve website, advising users to avoid interactions for the time being. The firm suggests it may be a potential frontend attack, where hackers target the interactive elements of the website, such as buttons and forms, to steal sensitive information. Blockaid has urged users to refrain from signing transactions and interacting with the decentralized application until the issue is resolved, assuring that they are collaborating closely with affected partners. This incident follows another attack on Curve Finance's official X handle on May 5. The team clarified that the breach was confined to the X account, with no other Curve accounts affected, no security issues detected, and no user funds compromised. Access to the X account was swiftly restored, and the cause remains under investigation. Several other high-profile X accounts have been targeted by malicious actors this year, including the Tron DAO account on May 2 and UK Parliament member Lucy Powell's account on April 15, which was used to promote a scam crypto token.