Hijacking of 12 DeFi Sites Causes Estimated Losses of $202,386
Key Facts
The domains of 12 decentralized finance sites were hijacked in a campaign targeting cryptocurrency users, with Bitquery estimating user losses at $202,386 in withdrawals made between 01:00 and 05:33 UTC on October 31. The company said 32 wallets lost one dollar or more across six blockchains. The 12 domains were registered with Name.com, as identified by Blockaid and reported by The Block. The affected sites included Flap, Kintsu, Pickle Finance and Origami Finance. Bitquery based its estimate on the value of what victims lost at the time of withdrawal.
The Block reported a different total, tracking about $138,000 in the balances of three attacker wallets on Ethereum Virtual Machine-compatible chains as of the morning of October 31. The two figures are not the endpoints of a single range; they result from different methodologies, one measuring victims' losses at the time of withdrawal and the other tracking funds in attacker wallets. Bitquery said 81% of the withdrawn funds were on the Monad network. One share linked to the Kintsu platform consisted of funds that had not yet left the protocol. Bitquery valued that share at about $56,600 on the evening of October 31; it was still in the unstaking queue and had not been claimed by the attacker at that time.
Registration of the domains with Name.com was a common link among the sites identified by Blockaid, but that alone does not establish how their records were changed or who caused the changes. The Block reported that the sites did not use a single DNS provider. Some used Cloudflare or Vercel, while others used Name.com servers. Domain registration information therefore does not prove that Name.com was the point of compromise or that DNS records were changed through it. The published information did not identify the cause of the changes that led to the domain hijackings.
In a security alert dated October 31, Vercel said it was investigating a domain takeover campaign targeting cryptocurrency customers and reported that domains associated with its platform had been restored. An update to the notice that day referred to the restoration of 10 domains originating through Vercel. In another update, the company said 9 domains associated with its platform had been restored. The notice described the investigation into the campaign but did not determine the cause of the changes to the sites' records. These updates show that domain restoration was part of a response carried out on October 31.
Bitquery advised users of the affected sites to revoke any token approvals they had granted on October 30 or 31. The advice covered every chain a person uses, in light of losses recorded across six chains. The company urged users to check and revoke approvals granted on those two days. It also called on users to verify before reconnecting to the sites in question. The restoration actions announced by Vercel applied to the domains listed in its updates, while Bitquery's recommendation extended to token approvals on the chains used by traders.